Re: [PATCH] io_uring: add overflow checks for poll refcounting

[Dylan Yudaken <dylany@xxxxxx>]

On Wed, 2022-03-23 at 11:14 +0000, Pavel Begunkov wrote:
> 
...
>  
> -#define IO_POLL_CANCEL_FLAG    BIT(31)
> -#define IO_POLL_REF_MASK       GENMASK(30, 0)
> +/* keep the sign bit unused to improve overflow detection */
> +#define IO_POLL_CANCEL_FLAG    BIT(30)
> +#define IO_POLL_REF_MASK       GENMASK(29, 0)
> +
> +/* 2^16 is choosen arbitrary, would be funky to have more than that
> */
> +#define io_poll_ref_check_overflow(refs) ((unsigned int)refs >=
> 65536u)
> +#define io_poll_ref_check_underflow(refs) ((int)refs < 0)
>  

I believe if the cancel flag is set, then this will not catch an
underflow but the result will be the cancel flag unset. You could fix
by also checking for overflow on the masked bits.