[PATCH 1/2] io_uring/cancel: count all canceled futex and waitid requests on CANCEL_ALL

[agxr <agxr@disroot.org>]

With IORING_ASYNC_CANCEL_ALL, __io_async_cancel() calls io_try_cancel()
until it finds nothing more and adds 1 to the count for each call that
found something, which is correct for poll, io-wq and timeouts, which
cancel one request per call. io_futex_cancel() and io_waitid_cancel()
cancel all matches in a single call and return how many they canceled.
Three futex waits with the same user_data are all canceled by the first
call, which counts as one, and the cancel completes with 1, not 3.

Sum the return values of io_try_cancel() instead, so that the count is
the number of canceled requests, as io_uring_prep_cancel(3) documents.

Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait")
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Signed-off-by: agxr <agxr@disroot.org>
---
 io_uring/cancel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 6f7a6cf356c2..e4b27b79b05c 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -198,7 +198,7 @@ static int __io_async_cancel(struct io_cancel_data *cd,
 			break;
 		if (!all)
 			return ret;
-		nr++;
+		nr += ret > 0 ? ret : 1;
 	} while (1);
 
 	/* slow path, try all io-wq's */
-- 
2.56.0