Re: [PATCH] io_uring/poll: fix multishot recv missing EOF on wakeup race

[Pavel Begunkov <asml.silence@gmail.com>]

On 3/15/26 16:19, Jens Axboe wrote:
> When a socket send and shutdown() happen back-to-back, both fire
> wake-ups before the receiver's task_work has a chance to run. The first
> wake gets poll ownership (poll_refs=1), and the second bumps it to 2.
> When io_poll_check_events() runs, it calls io_poll_issue() which does a
> recv that reads the data and returns IOU_RETRY. The loop then drains all
> accumulated refs (atomic_sub_return(2) -> 0) and exits, even though only
> the first event was consumed. Since the shutdown is a persistent state
> change, no further wakeups will happen, and the multishot recv can hang
> forever.
> 
> Fix this by only draining a single poll ref after io_poll_issue()
> returns IOU_RETRY for the APOLL_MULTISHOT path. If additional wakes
> raced in (poll_refs was > 1), the loop iterates again, vfs_poll()
> discovers the remaining state.

How often will iterate with no effect for normal execution (i.e.
no shutdown)? And how costly it'll be? Why not handle HUP instead?

-- 
Pavel Begunkov