Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754146AbeAJVd0 (ORCPT + 1 other); Wed, 10 Jan 2018 16:33:26 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60178 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753449AbeAJV3c (ORCPT ); Wed, 10 Jan 2018 16:29:32 -0500 From: Jeff Moyer To: Christoph Hellwig Cc: viro@zeniv.linux.org.uk, Avi Kivity , linux-aio@kvack.org, linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 27/32] aio: sanitize ki_list handling References: <20180110155853.32348-1-hch@lst.de> <20180110155853.32348-28-hch@lst.de> X-PGP-KeyID: 1F78E1B4 X-PGP-CertKey: F6FE 280D 8293 F72C 65FD 5A58 1FF8 A7CA 1F78 E1B4 X-PCLoadLetter: What the f**k does that mean? Date: Wed, 10 Jan 2018 16:29:30 -0500 In-Reply-To: <20180110155853.32348-28-hch@lst.de> (Christoph Hellwig's message of "Wed, 10 Jan 2018 16:58:48 +0100") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 10 Jan 2018 21:29:32 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Christoph Hellwig writes: > Instead of handcoded non-null checks always initialize ki_list to an > empty list and use list_empty / list_empty_careful on it. Yeah, who knows why list_empty wasn't used from the beginning. In the past, tricks were played by overwriting list pointers with non-null, but that wasn't the case here. > While we're at it also error out on a double call to > kiocb_set_cancel_fn instead of ignoring it. > > Signed-off-by: Christoph Hellwig > --- > fs/aio.c | 13 ++++++------- > 1 file changed, 6 insertions(+), 7 deletions(-) > > diff --git a/fs/aio.c b/fs/aio.c > index 496b50f9e9b1..fe241b5b44b2 100644 > --- a/fs/aio.c > +++ b/fs/aio.c > @@ -555,13 +555,12 @@ void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel) > struct kioctx *ctx = req->ki_ctx; > unsigned long flags; > > - spin_lock_irqsave(&ctx->ctx_lock, flags); > - > - if (!req->ki_list.next) > - list_add(&req->ki_list, &ctx->active_reqs); > + if (WARN_ON_ONCE(!list_empty(&req->ki_list))) > + return; > > + spin_lock_irqsave(&ctx->ctx_lock, flags); > + list_add_tail(&req->ki_list, &ctx->active_reqs); > req->ki_cancel = cancel; So, this changes behavior from quietly overwriting the prior cancel function to not doing it. I don't think it matters one bit, though. Callers shouldn't do that. Acked-by: Jeff Moyer