On 7/23/20 12:12 PM, Pavel Begunkov wrote: > poll_add can have req->work initialised, which will be overwritten in > __io_arm_poll_handler() because of the union. Luckily, hash_node is > zeroed in the end, so the damage is limited to lost put for work.creds, > and probably corrupted work.list. > > That's the easiest and really dirty fix, which rearranges members in the > union, arm_poll*() modifies and zeroes only work.files and work.mm, > which are never taken for poll add. > note: io_kiocb is exactly 4 cachelines now. I don't think there's a way around moving task_work out, just like it was done on 5.9. The problem is that we could put the environment bits before doing task_work_add(), but we might need them if the subsequent queue ends up having to go async. So there's really no know when we can put them, outside of when the request finishes. Hence, we are kind of SOL here. -- Jens Axboe
