io_uring/poll: fix poll_refs race with cancelation

[platform/kernel/linux-starfive.git] / io_uring / poll.c

diff --git a/io_uring/poll.c b/io_uring/poll.c
index b444b7d..d9bf176 100644 (file)
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -308,7 +308,8 @@ static int io_poll_check_events(struct io_kiocb *req, bool *locked)
                 * Release all references, retry if someone tried to restart
                 * task_work while we were executing it.
                 */
-       } while (atomic_sub_return(v & IO_POLL_REF_MASK, &req->poll_refs));
+       } while (atomic_sub_return(v & IO_POLL_REF_MASK, &req->poll_refs) &
+                                       IO_POLL_REF_MASK);
 
        return IOU_POLL_NO_ACTION;
 }