io_poll_remove() expects poll_find() to search only for poll requests
and passes a flag for this. Just be a little bit extra cautious
considering lots of recent poll/cancellation changes and add a
WARN_ON_ONCE checking that we don't get an apoll'ed request.
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
---
io_uring/poll.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/io_uring/poll.c b/io_uring/poll.c
index d4bfc6d945cf..15a479a0dc64 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -824,6 +824,11 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
}
found:
+ if (WARN_ON_ONCE(preq->opcode != IORING_OP_POLL_ADD)) {
+ ret = -EFAULT;
+ goto out;
+ }
+
if (poll_update->update_events || poll_update->update_user_data) {
/* only mask one event flags, keep behavior flags */
if (poll_update->update_events) {
--
2.36.1
