Re: [PATCH 1/1] io_uring/poll: fix signed comparison in io_poll_get_ownership()

[Jens Axboe <axboe@kernel.dk>]

On 4/15/26 7:50 PM, Yuan Tan wrote:
> 
> On 4/15/26 13:09, Jens Axboe wrote:
>> On 4/12/26 2:38 AM, Ren Wei wrote:
>>> From: Longxuan Yu <ylong030@ucr.edu>
>>>
>>> io_poll_get_ownership() uses a signed comparison to check whether
>>> poll_refs has reached the threshold for the slowpath:
>>>
>>>     if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))
>>>
>>> atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
>>> (BIT(31)) is set in poll_refs, the value becomes negative in
>>> signed arithmetic, so the >= 128 comparison always evaluates to
>>> false and the slowpath is never taken.
>>>
>>> Fix this by casting the atomic_read() result to unsigned int
>>> before the comparison, so that the cancel flag is treated as a
>>> large positive value and correctly triggers the slowpath.
>>>
>>> Fixes: aa43477b0402 ("io_uring: poll rework")
>> Is this correct? Seems it should be:
>>
>> Fixes: a26a35e9019f ("io_uring: make poll refs more robust")
>>
> I just double check it. Yes we were wrong. Correct bug inducing commit is 
> 
> a26a35e9019f ("io_uring: make poll refs more robust").
> 
> Thanks for pointing it out.
> 
> 
> Do we need to send a v2 to fix this?

No need, I corrected it already while applying yesterday.

-- 
Jens Axboe