io_uring: kill poll linking optimisation

[ upstream commmit ab1dab960b8352cee082db0f8a54dc92a948bfd7 ]

With IORING_FEAT_FAST_POLL in place, io_put_req_find_next() for poll
requests doesn't make much sense, and in any case re-adding it
shouldn't be a problem considering batching in tctx_task_work(). We can
remove it.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/15699682bf81610ec901d4e79d6da64baa9f70be.1639605189.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 20bbcc316314faa8efb8453ceaa95ae128694448 linux-5.15.y)
CVE-2022-3176
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 9630c8af89e07fecdde22fb89de93e155eb897c3..71482d14d85b0db030802606d00d2c5dfcc6481d 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5452,7 +5452,6 @@ static inline bool io_poll_complete(struct io_kiocb *req, __poll_t mask)
 static void io_poll_task_func(struct io_kiocb *req, bool *locked)
 {
        struct io_ring_ctx *ctx = req->ctx;
-       struct io_kiocb *nxt;
 
        if (io_poll_rewait(req, &req->poll)) {
                spin_unlock(&ctx->completion_lock);
@@ -5476,11 +5475,8 @@ static void io_poll_task_func(struct io_kiocb *req, bool *locked)
                spin_unlock(&ctx->completion_lock);
                io_cqring_ev_posted(ctx);
 
-               if (done) {
-                       nxt = io_put_req_find_next(req);
-                       if (nxt)
-                               io_req_task_submit(nxt, locked);
-               }
+               if (done)
+                       io_put_req(req);
        }
 }