Commit 66d2d00d authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix uninit old data for poll event upd 



Both IORING_POLL_UPDATE_EVENTS and IORING_POLL_UPDATE_USER_DATA need
old_user_data to find/cancel a poll request, but it's set only for the
first one.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/ab08fd35b7652e977f9a475f01741b04102297f1.1618278933.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 08480400

fs/io_uring.c

+9 −9
Original line number Diff line number Diff line
@@ -5379,17 +5379,17 @@ static int io_poll_add_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe 
	if (!(flags & IORING_POLL_ADD_MULTI))

		events |= EPOLLONESHOT;

	poll->update_events = poll->update_user_data = false;

	if (flags & IORING_POLL_UPDATE_EVENTS) {

		poll->update_events = true;



	if (flags & (IORING_POLL_UPDATE_EVENTS|IORING_POLL_UPDATE_USER_DATA)) {

		poll->old_user_data = READ_ONCE(sqe->addr);

	}

	if (flags & IORING_POLL_UPDATE_USER_DATA) {

		poll->update_user_data = true;

		poll->update_events = flags & IORING_POLL_UPDATE_EVENTS;

		poll->update_user_data = flags & IORING_POLL_UPDATE_USER_DATA;

		if (poll->update_user_data)

			poll->new_user_data = READ_ONCE(sqe->off);

	}

	if (!(poll->update_events || poll->update_user_data) &&

	     (sqe->off || sqe->addr))

	} else {

		if (sqe->off || sqe->addr)

			return -EINVAL;

	}

	poll->events = demangle_poll(events) |

				(events & (EPOLLEXCLUSIVE|EPOLLONESHOT));

	return 0;