[PATCH] io_uring: fix invalid handler for double apoll

[Pavel Begunkov <asml.silence@gmail.com>]

io_poll_double_wake() is called for both: poll requests and as apoll
(internal poll to make rw and other requests), hence when it calls
__io_async_wake() it should use a right callback depending on the
current poll type.

Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 fs/io_uring.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 20781e939940..b2d72bd18fcf 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4927,6 +4927,8 @@ static void io_poll_task_func(struct callback_head *cb)
 	percpu_ref_put(&ctx->refs);
 }
 
+static void io_async_task_func(struct callback_head *cb);
+
 static int io_poll_double_wake(struct wait_queue_entry *wait, unsigned mode,
 			       int sync, void *key)
 {
@@ -4950,8 +4952,12 @@ static int io_poll_double_wake(struct wait_queue_entry *wait, unsigned mode,
 		/* make sure double remove sees this as being gone */
 		wait->private = NULL;
 		spin_unlock(&poll->head->lock);
-		if (!done)
-			__io_async_wake(req, poll, mask, io_poll_task_func);
+		if (!done) {
+			if (req->opcode == IORING_OP_POLL_ADD)
+				__io_async_wake(req, poll, mask, io_poll_task_func);
+			else
+				__io_async_wake(req, poll, mask, io_async_task_func);
+		}
 	}
 	refcount_dec(&req->refs);
 	return 1;
-- 
2.24.0