[AIO]: Split ki_user_obj into a 2 member union.

This documents how this member is used in two
ways, 1) as a pointer to a user ioctx and 2)
as a pointer to a task struct to wake up.

fs/aio.c

@@ -394,7 +394,7 @@ static struct kiocb fastcall *__aio_get_req(struct kioctx *ctx)
 	req->ki_ctx = ctx;
 	req->ki_cancel = NULL;
 	req->ki_retry = NULL;
-	req->ki_user_obj = NULL;
+	req->ki_obj.user = NULL;
 
 	/* Check if the completion queue has enough free space to
 	 * accept an event from this io.
@@ -437,7 +437,7 @@ static inline void really_put_req(struct kioctx *ctx, struct kiocb *req)
 {
 	req->ki_ctx = NULL;
 	req->ki_filp = NULL;
-	req->ki_user_obj = NULL;
+	req->ki_obj.user = NULL;
 	kmem_cache_free(kiocb_cachep, req);
 	ctx->reqs_active--;
 
@@ -605,7 +605,7 @@ void fastcall kick_iocb(struct kiocb *iocb)
 	 * single context. */
 	if (is_sync_kiocb(iocb)) {
 		kiocbSetKicked(iocb);
-		wake_up_process(iocb->ki_user_obj);
+		wake_up_process(iocb->ki_obj.tsk);
 		return;
 	}
 
@@ -653,7 +653,7 @@ int fastcall aio_complete(struct kiocb *iocb, long res, long res2)
 			spin_unlock_irq(&ctx->ctx_lock);
 		}
 		/* sync iocbs put the task here for us */
-		wake_up_process(iocb->ki_user_obj);
+		wake_up_process(iocb->ki_obj.tsk);
 		return ret;
 	}
 
@@ -673,13 +673,13 @@ int fastcall aio_complete(struct kiocb *iocb, long res, long res2)
 	event = aio_ring_event(info, tail, KM_IRQ0);
 	tail = (tail + 1) % info->nr;
 
-	event->obj = (u64)(unsigned long)iocb->ki_user_obj;
+	event->obj = (u64)(unsigned long)iocb->ki_obj.user;
 	event->data = iocb->ki_user_data;
 	event->res = res;
 	event->res2 = res2;
 
 	dprintk("aio_complete: %p[%lu]: %p: %p %Lx %lx %lx\n",
-		ctx, tail, iocb, iocb->ki_user_obj, iocb->ki_user_data,
+		ctx, tail, iocb, iocb->ki_obj.user, iocb->ki_user_data,
 		res, res2);
 
 	/* after flagging the request as done, we
@@ -1022,7 +1022,7 @@ int fastcall io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
 		goto out_put_req;
 	}
 
-	req->ki_user_obj = user_iocb;
+	req->ki_obj.user = user_iocb;
 	req->ki_user_data = iocb->aio_data;
 	req->ki_pos = iocb->aio_offset;
 
@@ -1148,7 +1148,7 @@ struct kiocb *lookup_kiocb(struct kioctx *ctx, struct iocb __user *iocb, u32 key
 	/* TODO: use a hash or array, this sucks. */
 	list_for_each(pos, &ctx->active_reqs) {
 		struct kiocb *kiocb = list_kiocb(pos);
-		if (kiocb->ki_user_obj == iocb && kiocb->ki_key == key)
+		if (kiocb->ki_obj.user == iocb && kiocb->ki_key == key)
 			return kiocb;
 	}
 	return NULL;
@@ -1195,7 +1195,7 @@ asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
 		struct io_event tmp;
 		pr_debug("calling cancel\n");
 		memset(&tmp, 0, sizeof(tmp));
-		tmp.obj = (u64)(unsigned long)kiocb->ki_user_obj;
+		tmp.obj = (u64)(unsigned long)kiocb->ki_obj.user;
 		tmp.data = kiocb->ki_user_data;
 		ret = cancel(kiocb, &tmp);
 		if (!ret) {

include/linux/aio.h

@@ -59,7 +59,10 @@ struct kiocb {
 	struct list_head	ki_list;	/* the aio core uses this
 						 * for cancellation */
 
-	void __user		*ki_user_obj;	/* pointer to userland's iocb */
+	union {
+		void __user		*user;
+		struct task_struct	*tsk;
+	} ki_obj;
 	__u64			ki_user_data;	/* user's data for completion */
 	loff_t			ki_pos;
 
@@ -76,7 +79,7 @@ struct kiocb {
 		(x)->ki_filp = (filp);			\
 		(x)->ki_ctx = &tsk->active_mm->default_kioctx;	\
 		(x)->ki_cancel = NULL;			\
-		(x)->ki_user_obj = tsk;			\
+		(x)->ki_obj.tsk = tsk;			\
 	} while (0)
 
 #define AIO_RING_MAGIC			0xa10a10a1