Commit b9231dfb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-5.13-2021-05-22' of git://git.kernel.dk/linux-block 

Pull io_uring fixes from Jens Axboe:
 "One fix for a regression with poll in this merge window, and another
  just hardens the io-wq exit path a bit"

* tag 'io_uring-5.13-2021-05-22' of git://git.kernel.dk/linux-block:
  io_uring: fortify tctx/io_wq cleanup
  io_uring: don't modify req->poll for rw
parents 23d72926 ba5ef6dc

fs/io_uring.c

+7 −7
Original line number Diff line number Diff line
@@ -5019,10 +5019,10 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, 
		 * Can't handle multishot for double wait for now, turn it

		 * into one-shot mode.

		 */

		if (!(req->poll.events & EPOLLONESHOT))

			req->poll.events |= EPOLLONESHOT;

		if (!(poll_one->events & EPOLLONESHOT))

			poll_one->events |= EPOLLONESHOT;

		/* double add on the same waitqueue head, ignore */

		if (poll->head == head)

		if (poll_one->head == head)

			return;

		poll = kmalloc(sizeof(*poll), GFP_ATOMIC);

		if (!poll) {
@@ -9035,15 +9035,15 @@ static void io_uring_del_task_file(unsigned long index) 


static void io_uring_clean_tctx(struct io_uring_task *tctx)

{

	struct io_wq *wq = tctx->io_wq;

	struct io_tctx_node *node;

	unsigned long index;



	tctx->io_wq = NULL;

	xa_for_each(&tctx->xa, index, node)

		io_uring_del_task_file(index);

	if (tctx->io_wq) {

		io_wq_put_and_exit(tctx->io_wq);

		tctx->io_wq = NULL;

	}

	if (wq)

		io_wq_put_and_exit(wq);

}



static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked)