Message ID | ec9a66f1e22f99dcd02288d4e42f3cc6bb357804.1655684496.git.asml.silence@gmail.com (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | 5.20 patches | expand |
diff --git a/io_uring/poll.c b/io_uring/poll.c index 9af6a34222a9..8f4fff76d3b4 100644 --- a/io_uring/poll.c +++ b/io_uring/poll.c @@ -827,6 +827,11 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) } found: + if (WARN_ON_ONCE(preq->opcode != IORING_OP_POLL_ADD)) { + ret = -EFAULT; + goto out; + } + if (poll_update->update_events || poll_update->update_user_data) { /* only mask one event flags, keep behavior flags */ if (poll_update->update_events) {
io_poll_remove() expects poll_find() to search only for poll requests and passes a flag for this. Just be a little bit extra cautious considering lots of recent poll/cancellation changes and add a WARN_ON_ONCE checking that we don't get an apoll'ed request. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/poll.c | 5 +++++ 1 file changed, 5 insertions(+)