From: Jens Axboe <axboe@xxxxxxxxx> commit 61bc84c4008812d784c398cfb54118c1ba396dfc upstream. When the ring is exiting, as part of the shutdown, poll requests are removed. But io_poll_remove_all() does not remove entries when finding them, and since completions are done out-of-band, we can find and remove the same entry multiple times. We do guard the poll execution by poll ownership, but that does not exclude us from reissuing a new one once the previous removal ownership goes away. This can race with poll execution as well, where we then end up seeing req->apoll be NULL because a previous task_work requeue finished the request. Remove the poll entry when we find it and get ownership of it. This prevents multiple invocations from finding it. Fixes: aa43477b0402 ("io_uring: poll rework") Reported-by: Dylan Yudaken <dylany@xxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5870,6 +5870,7 @@ static __cold bool io_poll_remove_all(st list = &ctx->cancel_hash[i]; hlist_for_each_entry_safe(req, tmp, list, hash_node) { if (io_match_task_safe(req, tsk, cancel_all)) { + hlist_del_init(&req->hash_node); io_poll_cancel_req(req); found = true; } Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-5.17/block-fix-the-maximum-minor-value-is-blk_alloc_ext_minor.patch queue-5.17/block-ensure-plug-merging-checks-the-correct-queue-at-least-once.patch queue-5.17/block-don-t-merge-across-cgroup-boundaries-if-blkcg-is-enabled.patch queue-5.17/block-limit-request-dispatch-loop-duration.patch queue-5.17/block-bfq-don-t-move-oom_bfqq.patch queue-5.17/block-don-t-delete-queue-kobject-before-its-children.patch queue-5.17/io_uring-bump-poll-refs-to-full-31-bits.patch queue-5.17/io_uring-fix-memory-leak-of-uid-in-files-registration.patch queue-5.17/block-throttle-split-bio-in-case-of-iops-limit.patch queue-5.17/loop-fix-ioctl-calls-using-compat_loop_info.patch queue-5.17/bfq-fix-use-after-free-in-bfq_dispatch_request.patch queue-5.17/block-flush-plug-based-on-hardware-and-software-queue-order.patch queue-5.17/block-restore-the-old-set_task_ioprio-behaviour-wrt-pf_exiting.patch queue-5.17/io_uring-terminate-manual-loop-iterator-loop-correct.patch queue-5.17/memstick-mspro_block-fix-handling-of-read-only-devic.patch queue-5.17/block-bfq_wf2q-correct-weight-to-ioprio.patch queue-5.17/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch queue-5.17/revert-revert-block-bfq-honor-already-setup-queue-me.patch queue-5.17/block-update-io_ticks-when-io-hang.patch queue-5.17/drbd-fix-potential-silent-data-corruption.patch queue-5.17/io_uring-remove-poll-entry-from-list-when-canceling-all.patch queue-5.17/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch queue-5.17/block-fix-rq-qos-breakage-from-skipping-rq_qos_done_bio.patch queue-5.17/io_uring-ensure-that-fsnotify-is-always-called.patch queue-5.17/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch