io_uring: pass only !null to io_req_find_next()

mainline inclusion
from mainline-5.5-rc1
commit 944e58bf
category: feature
bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=27
CVE: NA
---------------------------

Make io_req_find_next() and io_req_link_next() to accept only non-null
nxt, and handle it in callers.
Signed-off-by: NPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NZhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Nyangerkun <yangerkun@huawei.com>
Reviewed-by: Nzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: NCheng Jian <cj.chengjian@huawei.com>

fs/io_uring.c

@@ -907,7 +907,7 @@ static void io_req_link_next(struct io_kiocb *req, struct io_kiocb **nxtptr)
 		 * in this context instead of having to queue up new async work.
 		 */
 		if (nxt) {
-			if (nxtptr && io_wq_current_is_worker())
+			if (io_wq_current_is_worker())
 				*nxtptr = nxt;
 			else
 				io_queue_async_work(nxt);
@@ -985,8 +985,13 @@ static void io_req_find_next(struct io_kiocb *req, struct io_kiocb **nxt)
 
 static void io_free_req(struct io_kiocb *req)
 {
-	io_req_find_next(req, NULL);
+	struct io_kiocb *nxt = NULL;
+
+	io_req_find_next(req, &nxt);
 	__io_free_req(req);
+
+	if (nxt)
+		io_queue_async_work(nxt);
 }
 
 /*