]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
authorJens Axboe <axboe@kernel.dk>
Mon, 16 Feb 2026 21:16:27 +0000 (14:16 -0700)
committerJens Axboe <axboe@kernel.dk>
Mon, 16 Feb 2026 21:16:27 +0000 (14:16 -0700)
By having them share the same space in struct io_cancel_data, it ends up
disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from
working. Eg you cannot match on both a file and user_data for
cancelation purposes. This obviously isn't a common use case as nobody
has reported this, but it does result in -ENOENT potentially being
returned when trying to match on both, rather than actually doing what
the API says it would.

Fixes: 4bf94615b888 ("io_uring: allow IORING_OP_ASYNC_CANCEL with 'fd' key")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
io_uring/cancel.h

index 6783961ede1bfc952395c6d5a0c8d7bfdbd6519a..1b201a0943030eee0a027eba4a7aee659c45e911 100644 (file)
@@ -6,10 +6,8 @@
 
 struct io_cancel_data {
        struct io_ring_ctx *ctx;
-       union {
-               u64 data;
-               struct file *file;
-       };
+       u64 data;
+       struct file *file;
        u8 opcode;
        u32 flags;
        int seq;