io_uring: fix double poll mask init

__io_queue_proc() is used by both, poll reqs and apoll. Don't use
req->poll.events to copy poll mask because for apoll it aliases with
private data of the request.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index b9ffe98f18bc9b9803e007bc8362b6352c411a4d..e1726f45746148c4e3eee65a32bdebc1166a262b 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5008,6 +5008,8 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt,
         * for write). Setup a separate io_poll_iocb if this happens.
         */
        if (unlikely(poll->head)) {
+               struct io_poll_iocb *poll_one = poll;
+
                /* already have a 2nd entry, fail a third attempt */
                if (*poll_ptr) {
                        pt->error = -EINVAL;
@@ -5018,7 +5020,7 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt,
                        pt->error = -ENOMEM;
                        return;
                }
-               io_init_poll_iocb(poll, req->poll.events, io_poll_double_wake);
+               io_init_poll_iocb(poll, poll_one->events, io_poll_double_wake);
                refcount_inc(&req->refs);
                poll->wait.private = req;
                *poll_ptr = poll;