History

io_uring/poll: don't reissue in case of poll race on multishot request

A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.

Jens Axboe committed 3 years ago

Commit 8caa03f1 parent 85795381 file · +5 −1Browse files

Unified · Split

io_uring/poll.c+5−1
@@ -283,8 +283,12 @@ static int io_poll_check_events(struct io_kiocb *req, bool *locked) · 282 unmodified lines
283283 * to the waitqueue, so if we get nothing back, we
284284 * should be safe and attempt a reissue.
285285 */
286− if (unlikely(!req->cqe.res))
286+ if (unlikely(!req->cqe.res)) {
287+ /* Multishot armed need not reissue */
288+ if (!(req->apoll_events & EPOLLONESHOT))
289+ continue;
287290 return IOU_POLL_REISSUE;
291+ }
288292 }
289293 if (req->apoll_events & EPOLLONESHOT)
290294 return IOU_POLL_DONE;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t