lkml.org 
[lkml]   [2022]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 20/73] io_uring: bump poll refs to full 31-bits
    Date
    From: Jens Axboe <axboe@kernel.dk>

    [ upstream commmit e2c0cb7c0cc72939b61a7efee376206725796625 ]

    The previous commit:

    1bc84c40088 ("io_uring: remove poll entry from list when canceling all")

    removed a potential overflow condition for the poll references. They
    are currently limited to 20-bits, even if we have 31-bits available. The
    upper bit is used to mark for cancelation.

    Bump the poll ref space to 31-bits, making that kind of situation much
    harder to trigger in general. We'll separately add overflow checking
    and handling.

    Fixes: aa43477b0402 ("io_uring: poll rework")
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    [pavel: backport]
    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/io_uring.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -5314,7 +5314,7 @@ struct io_poll_table {
    };

    #define IO_POLL_CANCEL_FLAG BIT(31)
    -#define IO_POLL_REF_MASK ((1u << 20)-1)
    +#define IO_POLL_REF_MASK GENMASK(30, 0)

    /*
    * If refs part of ->poll_refs (see IO_POLL_REF_MASK) is 0, it's free. We can

    \
     
     \ /
      Last update: 2022-09-02 15:07    [W:2.630 / U:0.224 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site