mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 14:44:12 +00:00
Code Issues Releases Wiki Activity

io_uring: fix uninit old data for poll event upd

Browse source 
Both IORING_POLL_UPDATE_EVENTS and IORING_POLL_UPDATE_USER_DATA need
old_user_data to find/cancel a poll request, but it's set only for the
first one.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/ab08fd35b7652e977f9a475f01741b04102297f1.1618278933.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2021-04-13 02:58:39 +01:00 committed by Jens Axboe
parent 084804002e
commit 66d2d00d0a
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
fs/io_uring.c
View file

@ -5379,17 +5379,17 @@ static int io_poll_add_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
if (!(flags & IORING_POLL_ADD_MULTI))
events |= EPOLLONESHOT;
poll->update_events = poll->update_user_data = false;
if (flags & IORING_POLL_UPDATE_EVENTS) {
poll->update_events = true;
if (flags & (IORING_POLL_UPDATE_EVENTS|IORING_POLL_UPDATE_USER_DATA)) {
poll->old_user_data = READ_ONCE(sqe->addr);
poll->update_events = flags & IORING_POLL_UPDATE_EVENTS;
poll->update_user_data = flags & IORING_POLL_UPDATE_USER_DATA;
if (poll->update_user_data)
poll->new_user_data = READ_ONCE(sqe->off);
} else {
if (sqe->off || sqe->addr)
return -EINVAL;
}
if (flags & IORING_POLL_UPDATE_USER_DATA) {
poll->update_user_data = true;
poll->new_user_data = READ_ONCE(sqe->off);
}
if (!(poll->update_events || poll->update_user_data) &&
(sqe->off || sqe->addr))
return -EINVAL;
poll->events = demangle_poll(events) |
(events & (EPOLLEXCLUSIVE|EPOLLONESHOT));
return 0;