This is a note to let you know that I've just added the patch titled
io_uring: refactor poll update
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
io_uring-refactor-poll-update.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Thu Sep 1 11:59:31 AM CEST 2022
From: Pavel Begunkov <asml.silence@xxxxxxxxx>
Date: Mon, 29 Aug 2022 14:30:14 +0100
Subject: io_uring: refactor poll update
To: stable@xxxxxxxxxxxxxxx
Cc: Jens Axboe <axboe@xxxxxxxxx>, asml.silence@xxxxxxxxx
Message-ID: <decb6e4ea41a43485fcdd1853cca4af0bd3ed526.1661594698.git.asml.silence@xxxxxxxxx>
From: Pavel Begunkov <asml.silence@xxxxxxxxx>
[ upstream commmit 2bbb146d96f4b45e17d6aeede300796bc1a96d68 ]
Clean up io_poll_update() and unify cancellation paths for remove and
update.
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
Link: https://lore.kernel.org/r/5937138b6265a1285220e2fab1b28132c1d73ce3.1639605189.git.asml.silence@xxxxxxxxx
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/io_uring.c | 62 ++++++++++++++++++++++++----------------------------------
1 file changed, 26 insertions(+), 36 deletions(-)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5931,61 +5931,51 @@ static int io_poll_update(struct io_kioc
struct io_ring_ctx *ctx = req->ctx;
struct io_kiocb *preq;
bool completing;
- int ret;
+ int ret2, ret = 0;
spin_lock(&ctx->completion_lock);
preq = io_poll_find(ctx, req->poll_update.old_user_data, true);
if (!preq) {
ret = -ENOENT;
- goto err;
- }
-
- if (!req->poll_update.update_events && !req->poll_update.update_user_data) {
- completing = true;
- ret = io_poll_remove_one(preq) ? 0 : -EALREADY;
- goto err;
+fail:
+ spin_unlock(&ctx->completion_lock);
+ goto out;
}
-
+ io_poll_remove_double(preq);
/*
* Don't allow racy completion with singleshot, as we cannot safely
* update those. For multishot, if we're racing with completion, just
* let completion re-add it.
*/
- io_poll_remove_double(preq);
completing = !__io_poll_remove_one(preq, &preq->poll, false);
if (completing && (preq->poll.events & EPOLLONESHOT)) {
ret = -EALREADY;
- goto err;
- }
- /* we now have a detached poll request. reissue. */
- ret = 0;
-err:
- if (ret < 0) {
- spin_unlock(&ctx->completion_lock);
- req_set_fail(req);
- io_req_complete(req, ret);
- return 0;
- }
- /* only mask one event flags, keep behavior flags */
- if (req->poll_update.update_events) {
- preq->poll.events &= ~0xffff;
- preq->poll.events |= req->poll_update.events & 0xffff;
- preq->poll.events |= IO_POLL_UNMASK;
+ goto fail;
}
- if (req->poll_update.update_user_data)
- preq->user_data = req->poll_update.new_user_data;
spin_unlock(&ctx->completion_lock);
+ if (req->poll_update.update_events || req->poll_update.update_user_data) {
+ /* only mask one event flags, keep behavior flags */
+ if (req->poll_update.update_events) {
+ preq->poll.events &= ~0xffff;
+ preq->poll.events |= req->poll_update.events & 0xffff;
+ preq->poll.events |= IO_POLL_UNMASK;
+ }
+ if (req->poll_update.update_user_data)
+ preq->user_data = req->poll_update.new_user_data;
+
+ ret2 = io_poll_add(preq, issue_flags);
+ /* successfully updated, don't complete poll request */
+ if (!ret2)
+ goto out;
+ }
+ req_set_fail(preq);
+ io_req_complete(preq, -ECANCELED);
+out:
+ if (ret < 0)
+ req_set_fail(req);
/* complete update request, we're done with it */
io_req_complete(req, ret);
-
- if (!completing) {
- ret = io_poll_add(preq, issue_flags);
- if (ret < 0) {
- req_set_fail(preq);
- io_req_complete(preq, ret);
- }
- }
return 0;
}
Patches currently in stable-queue which might be from asml.silence@xxxxxxxxx are
queue-5.15/io_uring-fix-wrong-arm_poll-error-handling.patch
queue-5.15/io_uring-poll-rework.patch
queue-5.15/io_uring-remove-unused-function-req_ref_put.patch
queue-5.15/io_uring-fail-links-when-poll-fails.patch
queue-5.15/io_uring-inline-io_poll_complete.patch
queue-5.15/io_uring-bump-poll-refs-to-full-31-bits.patch
queue-5.15/io_uring-clean-cqe-filling-functions.patch
queue-5.15/io_uring-fix-uaf-due-to-missing-pollfree-handling.patch
queue-5.15/io_uring-correct-fill-events-helpers-types.patch
queue-5.15/io_uring-refactor-poll-update.patch
queue-5.15/io_uring-kill-poll-linking-optimisation.patch
queue-5.15/io_uring-remove-poll-entry-from-list-when-canceling-all.patch
queue-5.15/io_uring-move-common-poll-bits.patch
