diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-04-13 02:58:39 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-04-13 09:37:54 -0600 |
| commit | 66d2d00d0ac44f98499dc7ec61e2289eb8b138e7 (patch) | |
| tree | aa8cfa14f30f66c4ccfd2a30b4237b1f7690f3d6 /fs/io_uring.c | |
| parent | 084804002e512427bfe52b448cb7cac0d4209b64 (diff) | |
| download | lwn-66d2d00d0ac44f98499dc7ec61e2289eb8b138e7.tar.gz lwn-66d2d00d0ac44f98499dc7ec61e2289eb8b138e7.zip | |
io_uring: fix uninit old data for poll event upd
Both IORING_POLL_UPDATE_EVENTS and IORING_POLL_UPDATE_USER_DATA need
old_user_data to find/cancel a poll request, but it's set only for the
first one.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/ab08fd35b7652e977f9a475f01741b04102297f1.1618278933.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 1af8bb5f7d56..57ee3d29182f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5379,17 +5379,17 @@ static int io_poll_add_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe if (!(flags & IORING_POLL_ADD_MULTI)) events |= EPOLLONESHOT; poll->update_events = poll->update_user_data = false; - if (flags & IORING_POLL_UPDATE_EVENTS) { - poll->update_events = true; + + if (flags & (IORING_POLL_UPDATE_EVENTS|IORING_POLL_UPDATE_USER_DATA)) { poll->old_user_data = READ_ONCE(sqe->addr); + poll->update_events = flags & IORING_POLL_UPDATE_EVENTS; + poll->update_user_data = flags & IORING_POLL_UPDATE_USER_DATA; + if (poll->update_user_data) + poll->new_user_data = READ_ONCE(sqe->off); + } else { + if (sqe->off || sqe->addr) + return -EINVAL; } - if (flags & IORING_POLL_UPDATE_USER_DATA) { - poll->update_user_data = true; - poll->new_user_data = READ_ONCE(sqe->off); - } - if (!(poll->update_events || poll->update_user_data) && - (sqe->off || sqe->addr)) - return -EINVAL; poll->events = demangle_poll(events) | (events & (EPOLLEXCLUSIVE|EPOLLONESHOT)); return 0; |