On 15/06/2020 16:36, Pavel Begunkov wrote:
> Don't leave garbage in req.work before punting async on -EAGAIN
> in io_iopoll_queue().
oops, cc'ed a wrong person.
+Cc: Xiaoguang Wang
>
> [ 140.922099] general protection fault, probably for non-canonical
> address 0xdead000000000100: 0000 [#1] PREEMPT SMP PTI
> ...
> [ 140.922105] RIP: 0010:io_worker_handle_work+0x1db/0x480
> ...
> [ 140.922114] Call Trace:
> [ 140.922118] ? __next_timer_interrupt+0xe0/0xe0
> [ 140.922119] io_wqe_worker+0x2a9/0x360
> [ 140.922121] ? _raw_spin_unlock_irqrestore+0x24/0x40
> [ 140.922124] kthread+0x12c/0x170
> [ 140.922125] ? io_worker_handle_work+0x480/0x480
> [ 140.922126] ? kthread_park+0x90/0x90
> [ 140.922127] ret_from_fork+0x22/0x30
>
> Fixes: 7cdaf587de7c ("io_uring: avoid whole io_wq_work copy for requests
> completed inline")
> Signed-off-by: Pavel Begunkov <[email protected]>
> ---
> fs/io_uring.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 54addaba742d..410b2df16c71 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -1105,6 +1105,7 @@ static inline void io_prep_async_work(struct io_kiocb
> *req,
> req->work.flags |= IO_WQ_WORK_UNBOUND;
> }
>
> + io_req_init_async(req);
> io_req_work_grab_env(req, def);
>
> *link = io_prep_linked_timeout(req);
>
--
Pavel Begunkov
