io_ring_submit() finalises with 1. io_commit_sqring(), which releases sqes to the userspace 2. Then calls to io_queue_link_head(), accessing released head's sqe Reorder them.
Unified · Split
| @@ -2795,13 +2795,14 @@ out: · 2794 unmodified lines | |||
| 2795 | submit++; | 2795 | submit++; |
| 2796 | io_submit_sqe(ctx, &s, statep, &link); | 2796 | io_submit_sqe(ctx, &s, statep, &link); |
| 2797 | } | 2797 | } |
| 2798 | io_commit_sqring(ctx); | ||
| 2799 | 2798 | ||
| 2800 | if (link) | 2799 | if (link) |
| 2801 | io_queue_link_head(ctx, link, &link->submit, shadow_req); | 2800 | io_queue_link_head(ctx, link, &link->submit, shadow_req); |
| 2802 | if (statep) | 2801 | if (statep) |
| 2803 | io_submit_state_end(statep); | 2802 | io_submit_state_end(statep); |
| 2804 | 2803 | ||
| 2804 | io_commit_sqring(ctx); | ||
| 2805 | |||
| 2805 | return submit; | 2806 | return submit; |
| 2806 | } | 2807 | } |
| 2807 | 2808 | ||