summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPavel Begunkov <asml.silence@gmail.com>2020-10-16 20:55:56 +0100
committerJens Axboe <axboe@kernel.dk>2020-10-16 15:08:06 -0600
commit6c86f313603838b32d4f1dcdd382da155e8359cf (patch)
tree88c9e0a8d76c36d772c51fd309b837c2a03cbb2c
parent083d16268aaf9288fa03596360054bd46dc72446 (diff)
io_uring: fix double poll mask initio_uring-5.10-next
__io_queue_proc() is used by both, poll reqs and apoll. Don't use req->poll.events to copy poll mask because for apoll it aliases with private data of the request. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--fs/io_uring.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 1325e4989fe6..0e9530d8b4e2 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5008,6 +5008,8 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt,
* for write). Setup a separate io_poll_iocb if this happens.
*/
if (unlikely(poll->head)) {
+ struct io_poll_iocb *poll_one = poll;
+
/* already have a 2nd entry, fail a third attempt */
if (*poll_ptr) {
pt->error = -EINVAL;
@@ -5018,7 +5020,7 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt,
pt->error = -ENOMEM;
return;
}
- io_init_poll_iocb(poll, req->poll.events, io_poll_double_wake);
+ io_init_poll_iocb(poll, poll_one->events, io_poll_double_wake);
refcount_inc(&req->refs);
poll->wait.private = req;
*poll_ptr = poll;