If IORING_POLL_UPDATE_EVENTS is used to updated the mask of a pending
poll request, then we mask off the bottom 16 bits and mask in the new
ones. But this prevents updating higher entry bits, which wasn't the
intent.
Rather than play masking games, simply overwrite the existing poll
entry mask with the new one.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: b69de288e913 ("io_uring: allow events and user_data update of running poll requests")
Link: https://github.com/axboe/liburing/issues/1099
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
---
diff --git a/io_uring/poll.c b/io_uring/poll.c
index 5f779139cae1..721f42a14c3e 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -1030,8 +1030,7 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
if (poll_update->update_events) {
struct io_poll *poll = io_kiocb_to_cmd(preq, struct io_poll);
- poll->events &= ~0xffff;
- poll->events |= poll_update->events & 0xffff;
+ poll->events = poll_update->events;
poll->events |= IO_POLL_UNMASK;
}
if (poll_update->update_user_data)
--
Jens Axboe
