io_uring: fix unrelated ctx reqs cancellation

io-wq now is per-task, so cancellations now should match against
request's ctx.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2021-03-08 12:14:14 +00:00 committed by Jens Axboe
parent 05962f95f9
commit f458dd8441
1 changed files with 13 additions and 6 deletions

View File

@ -5573,22 +5573,30 @@ static int io_timeout(struct io_kiocb *req, unsigned int issue_flags)
return 0;
}
struct io_cancel_data {
struct io_ring_ctx *ctx;
u64 user_data;
};
static bool io_cancel_cb(struct io_wq_work *work, void *data)
{
struct io_kiocb *req = container_of(work, struct io_kiocb, work);
struct io_cancel_data *cd = data;
return req->user_data == (unsigned long) data;
return req->ctx == cd->ctx && req->user_data == cd->user_data;
}
static int io_async_cancel_one(struct io_uring_task *tctx, void *sqe_addr)
static int io_async_cancel_one(struct io_uring_task *tctx, u64 user_data,
struct io_ring_ctx *ctx)
{
struct io_cancel_data data = { .ctx = ctx, .user_data = user_data, };
enum io_wq_cancel cancel_ret;
int ret = 0;
if (!tctx->io_wq)
if (!tctx || !tctx->io_wq)
return -ENOENT;
cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, sqe_addr, false);
cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, &data, false);
switch (cancel_ret) {
case IO_WQ_CANCEL_OK:
ret = 0;
@ -5611,8 +5619,7 @@ static void io_async_find_and_cancel(struct io_ring_ctx *ctx,
unsigned long flags;
int ret;
ret = io_async_cancel_one(req->task->io_uring,
(void *) (unsigned long) sqe_addr);
ret = io_async_cancel_one(req->task->io_uring, sqe_addr, ctx);
if (ret != -ENOENT) {
spin_lock_irqsave(&ctx->completion_lock, flags);
goto done;