io_uring: use type appropriate io_kiocb handler for double poll

io_poll_double_wake() is called for both request types - both pure poll
requests, and internal polls. This means that we should be using the
right handler based on the request type. Use the one that the original
caller already assigned for the waitqueue handling, that will always
match the correct type.

Cc: stable@vger.kernel.org # v5.8+
Reported-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 74dcc4471e9bdd196a784a6af1c725b7f2db1d35..2f6af230e86e82e838967809f8078bf672e0ad85 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4959,8 +4959,10 @@ static int io_poll_double_wake(struct wait_queue_entry *wait, unsigned mode,
                /* make sure double remove sees this as being gone */
                wait->private = NULL;
                spin_unlock(&poll->head->lock);
-               if (!done)
-                       __io_async_wake(req, poll, mask, io_poll_task_func);
+               if (!done) {
+                       /* use wait func handler, so it matches the rq type */
+                       poll->wait.func(&poll->wait, mode, sync, key);
+               }
        }
        refcount_dec(&req->refs);
        return 1;