From: Jens Axboe <axboe@xxxxxxxxx>
commit e2c0cb7c0cc72939b61a7efee376206725796625 upstream.
The previous commit:
1bc84c40088 ("io_uring: remove poll entry from list when canceling all")
removed a potential overflow condition for the poll references. They
are currently limited to 20-bits, even if we have 31-bits available. The
upper bit is used to mark for cancelation.
Bump the poll ref space to 31-bits, making that kind of situation much
harder to trigger in general. We'll separately add overflow checking
and handling.
Fixes: aa43477b0402 ("io_uring: poll rework")
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/io_uring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5414,7 +5414,7 @@ struct io_poll_table {
};
#define IO_POLL_CANCEL_FLAG BIT(31)
-#define IO_POLL_REF_MASK ((1u << 20)-1)
+#define IO_POLL_REF_MASK GENMASK(30, 0)
/*
* If refs part of ->poll_refs (see IO_POLL_REF_MASK) is 0, it's free. We can
Patches currently in stable-queue which might be from axboe@xxxxxxxxx are
queue-5.17/block-fix-the-maximum-minor-value-is-blk_alloc_ext_minor.patch
queue-5.17/block-ensure-plug-merging-checks-the-correct-queue-at-least-once.patch
queue-5.17/block-don-t-merge-across-cgroup-boundaries-if-blkcg-is-enabled.patch
queue-5.17/block-limit-request-dispatch-loop-duration.patch
queue-5.17/block-bfq-don-t-move-oom_bfqq.patch
queue-5.17/block-don-t-delete-queue-kobject-before-its-children.patch
queue-5.17/io_uring-bump-poll-refs-to-full-31-bits.patch
queue-5.17/io_uring-fix-memory-leak-of-uid-in-files-registration.patch
queue-5.17/block-throttle-split-bio-in-case-of-iops-limit.patch
queue-5.17/loop-fix-ioctl-calls-using-compat_loop_info.patch
queue-5.17/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
queue-5.17/block-flush-plug-based-on-hardware-and-software-queue-order.patch
queue-5.17/block-restore-the-old-set_task_ioprio-behaviour-wrt-pf_exiting.patch
queue-5.17/io_uring-terminate-manual-loop-iterator-loop-correct.patch
queue-5.17/memstick-mspro_block-fix-handling-of-read-only-devic.patch
queue-5.17/block-bfq_wf2q-correct-weight-to-ioprio.patch
queue-5.17/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
queue-5.17/revert-revert-block-bfq-honor-already-setup-queue-me.patch
queue-5.17/block-update-io_ticks-when-io-hang.patch
queue-5.17/drbd-fix-potential-silent-data-corruption.patch
queue-5.17/io_uring-remove-poll-entry-from-list-when-canceling-all.patch
queue-5.17/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
queue-5.17/block-fix-rq-qos-breakage-from-skipping-rq_qos_done_bio.patch
queue-5.17/io_uring-ensure-that-fsnotify-is-always-called.patch
queue-5.17/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
