io_uring/timeout: fix multishot updates

commit c83c846231db8b153bfcb44d552d373c34f78245 upstream.

After update only the first shot of a multishot timeout request adheres
to the new timeout value while all subsequent retries continue to use
the old value. Don't forget to update the timeout stored in struct
io_timeout_data.

Cc: stable@vger.kernel.org
Fixes: ea97f6c8558e8 ("io_uring: add support for multishot timeouts")
Reported-by: Christian Mazakas <christian.mazakas@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e6516c3304eb654ec234cfa65c88a9579861e597.1736015288.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 9973876d91b0ef32010691e60b249988a76bdbe9..21c4bfea79f1c9efb54bc6e3dac82771669c0704 100644 (file)
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -409,10 +409,12 @@ static int io_timeout_update(struct io_ring_ctx *ctx, __u64 user_data,
 
        timeout->off = 0; /* noseq */
        data = req->async_data;
+       data->ts = *ts;
+
        list_add_tail(&timeout->list, &ctx->timeout_list);
        hrtimer_init(&data->timer, io_timeout_get_clock(data), mode);
        data->timer.function = io_timeout_fn;
-       hrtimer_start(&data->timer, timespec64_to_ktime(*ts), mode);
+       hrtimer_start(&data->timer, timespec64_to_ktime(data->ts), mode);
        return 0;
 }