Commit 84230ad2 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring/poll: correctly handle io_poll_add() return value on update 



When the core of io_uring was updated to handle completions
consistently and with fixed return codes, the POLL_REMOVE opcode
with updates got slightly broken. If a POLL_ADD is pending and
then POLL_REMOVE is used to update the events of that request, if that
update causes the POLL_ADD to now trigger, then that completion is lost
and a CQE is never posted.

Additionally, ensure that if an update does cause an existing POLL_ADD
to complete, that the completion value isn't always overwritten with
-ECANCELED. For that case, whatever io_poll_add() set the value to
should just be retained.

Cc: stable@vger.kernel.org
Fixes: 97b388d7 ("io_uring: handle completions in the core")
Reported-by: default avatar <syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 559e608c

io_uring/poll.c

+7 −2
Original line number Diff line number Diff line
@@ -937,12 +937,17 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) 


		ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);

		/* successfully updated, don't complete poll request */

		if (!ret2 || ret2 == -EIOCBQUEUED)

		if (ret2 == IOU_ISSUE_SKIP_COMPLETE)

			goto out;

		/* request completed as part of the update, complete it */

		else if (ret2 == IOU_COMPLETE)

			goto complete;

	}



	req_set_fail(preq);

	io_req_set_res(preq, -ECANCELED, 0);

complete:

	if (preq->cqe.res < 0)

		req_set_fail(preq);

	preq->io_task_work.func = io_req_task_complete;

	io_req_task_work_add(preq);

out: