Older kernels lack io_uring POLLFREE handling. As only affected files are signalfd and android binder the safest option would be to disable polling those files via io_uring and hope there are no users.

Signed-off-by: Pavel Begunkov asml.silence@gmail.com --- drivers/android/binder.c | 1 + fs/io_uring.c | 3 +++ fs/signalfd.c | 1 + include/linux/fs.h | 1 + 4 files changed, 6 insertions(+)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c index b9fb2a926944..c273d0df6939 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6083,6 +6083,7 @@ const struct file_operations binder_fops = { .open = binder_open, .flush = binder_flush, .release = binder_release, + .may_pollfree = true, };

static int __init init_binder_device(const char *name) diff --git a/fs/io_uring.c b/fs/io_uring.c index e73969fa96bc..501c7e14c07c 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1908,6 +1908,9 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe) __poll_t mask; u16 events;

+ if (req->file->f_op->may_pollfree) + return -EOPNOTSUPP; + if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL)) return -EINVAL; if (sqe->addr || sqe->ioprio || sqe->off || sqe->len || sqe->buf_index) diff --git a/fs/signalfd.c b/fs/signalfd.c index 3e94d181930f..c3415d969ecf 100644 --- a/fs/signalfd.c +++ b/fs/signalfd.c @@ -248,6 +248,7 @@ static const struct file_operations signalfd_fops = { .poll = signalfd_poll, .read = signalfd_read, .llseek = noop_llseek, + .may_pollfree = true, };

static int do_signalfd4(int ufd, sigset_t *mask, int flags) diff --git a/include/linux/fs.h b/include/linux/fs.h index ef118b8ba699..4ecbe12f6215 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1859,6 +1859,7 @@ struct file_operations { struct file *file_out, loff_t pos_out, loff_t len, unsigned int remap_flags); int (*fadvise)(struct file *, loff_t, loff_t, int); + bool may_pollfree; } __randomize_layout;

struct inode_operations {