io_uring: Fix ->data corruption on re-enqueue

work->data and work->list are shared in union. io_wq_assign_next() sets
->data if a req having a linked_timeout, but then io-wq may want to use
work->list, e.g. to do re-enqueue of a request, so corrupting ->data.

->data is not necessary, just remove it and extract linked_timeout
through @link_list.

Fixes: 60cf46ae6054 ("io-wq: hash dependent work")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io-wq.h b/fs/io-wq.h
index 298b21f4a4d2902cc7fa26770b89899f93e4962a..d2a5684bf673dc725a63a43ca2da57290b0d9c9c 100644 (file)
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -63,10 +63,7 @@ static inline void wq_node_del(struct io_wq_work_list *list,
 } while (0)
 
 struct io_wq_work {
-       union {
-               struct io_wq_work_node list;
-               void *data;
-       };
+       struct io_wq_work_node list;
        void (*func)(struct io_wq_work **);
        struct files_struct *files;
        struct mm_struct *mm;

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 05260ed485ad15ffd67cd18f75c3767511f8e4c4..1f61ea9c87fd8d4b85671d4124ade2e9e24138a9 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1567,9 +1567,10 @@ static void io_free_req(struct io_kiocb *req)
 
 static void io_link_work_cb(struct io_wq_work **workptr)
 {
-       struct io_wq_work *work = *workptr;
-       struct io_kiocb *link = work->data;
+       struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+       struct io_kiocb *link;
 
+       link = list_first_entry(&req->link_list, struct io_kiocb, link_list);
        io_queue_linked_timeout(link);
        io_wq_submit_work(workptr);
 }
@@ -1584,10 +1585,8 @@ static void io_wq_assign_next(struct io_wq_work **workptr, struct io_kiocb *nxt)
 
        *workptr = &nxt->work;
        link = io_prep_linked_timeout(nxt);
-       if (link) {
+       if (link)
                nxt->work.func = io_link_work_cb;
-               nxt->work.data = link;
-       }
 }
 
 /*