Re: [PATCH 1/1] io_uring/poll: fix signed comparison in io_poll_get_ownership()

[Jens Axboe <axboe@kernel.dk>]

On 4/12/26 2:38 AM, Ren Wei wrote:
> From: Longxuan Yu <ylong030@ucr.edu>
> 
> io_poll_get_ownership() uses a signed comparison to check whether
> poll_refs has reached the threshold for the slowpath:
> 
>     if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))
> 
> atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
> (BIT(31)) is set in poll_refs, the value becomes negative in
> signed arithmetic, so the >= 128 comparison always evaluates to
> false and the slowpath is never taken.
> 
> Fix this by casting the atomic_read() result to unsigned int
> before the comparison, so that the cancel flag is treated as a
> large positive value and correctly triggers the slowpath.
> 
> Fixes: aa43477b0402 ("io_uring: poll rework")

Is this correct? Seems it should be:

Fixes: a26a35e9019f ("io_uring: make poll refs more robust")

-- 
Jens Axboe