UPSTREAM: io_uring: remove poll entry from list when canceling all

[ upstream commmit 61bc84c4 ]

When the ring is exiting, as part of the shutdown, poll requests are
removed. But io_poll_remove_all() does not remove entries when finding
them, and since completions are done out-of-band, we can find and remove
the same entry multiple times.

We do guard the poll execution by poll ownership, but that does not
exclude us from reissuing a new one once the previous removal ownership
goes away.

This can race with poll execution as well, where we then end up seeing
req->apoll be NULL because a previous task_work requeue finished the
request.

Remove the poll entry when we find it and get ownership of it. This
prevents multiple invocations from finding it.

Fixes: aa43477b ("io_uring: poll rework")
Reported-by: Dylan Yudaken <dylany@fb.com>
Change-Id: I002142b0e8fd8a9eca1e1089a12feb7fa8769e9f
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7524ec52)
Bug: 268174392
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>