qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

io_uring/poll: correctly handle io_poll_add() return value on update

Browse Source 
JIRA: https://issues.redhat.com/browse/RHEL-141266

commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e
Author: Jens Axboe <axboe@kernel.dk>
Date:   Mon Dec 1 13:25:22 2025 -0700

    io_uring/poll: correctly handle io_poll_add() return value on update
    
    When the core of io_uring was updated to handle completions
    consistently and with fixed return codes, the POLL_REMOVE opcode
    with updates got slightly broken. If a POLL_ADD is pending and
    then POLL_REMOVE is used to update the events of that request, if that
    update causes the POLL_ADD to now trigger, then that completion is lost
    and a CQE is never posted.
    
    Additionally, ensure that if an update does cause an existing POLL_ADD
    to complete, that the completion value isn't always overwritten with
    -ECANCELED. For that case, whatever io_poll_add() set the value to
    should just be retained.
    
    Cc: stable@vger.kernel.org
    Fixes: 97b388d70b53 ("io_uring: handle completions in the core")
    Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
    Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
This commit is contained in:
Jeff Moyer
2026-01-14 12:00:18 -05:00
parent 3ec7546fbf
commit d9740e280a
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
io_uring/poll.c
+7 -2
View File
@@ -930,12 +930,17 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
/* successfully updated, don't complete poll request */
if (!ret2 || ret2 == -EIOCBQUEUED)
if (ret2 == IOU_ISSUE_SKIP_COMPLETE)
goto out;
/* request completed as part of the update, complete it */
else if (ret2 == IOU_COMPLETE)
goto complete;
}
req_set_fail(preq);
io_req_set_res(preq, -ECANCELED, 0);
complete:
if (preq->cqe.res < 0)
req_set_fail(preq);
preq->io_task_work.func = io_req_task_complete;
io_req_task_work_add(preq);
out: