io_poll_double_wake() is called for both: poll requests and as apoll (internal poll to make rw and other requests), hence when it calls __io_async_wake() it should use a right callback depending on the current poll type. Cc: stable@xxxxxxxxxxxxxxx # v5.8+ Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> --- fs/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 20781e939940..b2d72bd18fcf 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4927,6 +4927,8 @@ static void io_poll_task_func(struct callback_head *cb) percpu_ref_put(&ctx->refs); } +static void io_async_task_func(struct callback_head *cb); + static int io_poll_double_wake(struct wait_queue_entry *wait, unsigned mode, int sync, void *key) { @@ -4950,8 +4952,12 @@ static int io_poll_double_wake(struct wait_queue_entry *wait, unsigned mode, /* make sure double remove sees this as being gone */ wait->private = NULL; spin_unlock(&poll->head->lock); - if (!done) - __io_async_wake(req, poll, mask, io_poll_task_func); + if (!done) { + if (req->opcode == IORING_OP_POLL_ADD) + __io_async_wake(req, poll, mask, io_poll_task_func); + else + __io_async_wake(req, poll, mask, io_async_task_func); + } } refcount_dec(&req->refs); return 1; -- 2.24.0