submit->index is used only for inbound check in submission path (i.e.
head < ctx->sq_entries). However, it always will be true, as
1. it's already validated by io_get_sqring()
2. ctx->sq_entries can't be changedd inbetween, because of held
ctx->uring_lock and ctx->refs.
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
---
fs/io_uring.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 949faf14345e..710a0e8c1334 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -276,7 +276,6 @@ struct io_ring_ctx {
struct sqe_submit {
const struct io_uring_sqe *sqe;
struct file *ring_file;
- unsigned short index;
bool has_user : 1;
bool in_async : 1;
bool needs_fixed_file : 1;
@@ -2169,9 +2168,6 @@ static int __io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
req->user_data = READ_ONCE(s->sqe->user_data);
- if (unlikely(s->index >= ctx->sq_entries))
- return -EINVAL;
-
opcode = READ_ONCE(s->sqe->opcode);
switch (opcode) {
case IORING_OP_NOP:
@@ -2625,7 +2621,6 @@ static bool io_get_sqring(struct io_ring_ctx *ctx, struct sqe_submit *s)
head = READ_ONCE(sq_array[head & ctx->sq_mask]);
if (head < ctx->sq_entries) {
s->ring_file = NULL;
- s->index = head;
s->sqe = &ctx->sq_sqes[head];
s->sequence = ctx->cached_sq_head;
ctx->cached_sq_head++;
--
2.23.0
