diff mbox series

[SRU,Jammy,10/12] io_uring: fail links when poll fails

Message ID 20220919175810.689086-12-cascardo@canonical.com
State New
Headers show
Series [SRU,Jammy,01/12] io_uring: refactor poll update | expand

Commit Message

Thadeu Lima de Souza Cascardo Sept. 19, 2022, 5:58 p.m. UTC 
From: Pavel Begunkov <asml.silence@gmail.com>

[ upstream commmit c487a5ad48831afa6784b368ec40d0ee50f2fe1b ]

Don't forget to cancel all linked requests of poll request when
__io_arm_poll_handler() failed.

Fixes: aa43477b04025 ("io_uring: poll rework")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/a78aad962460f9fdfe4aa4c0b62425c88f9415bc.1655852245.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6c7259c83773f22f05159db51ca64d05057259f3 linux-5.15.y)
CVE-2022-3176
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2dbef0835d51..0a14cb2c55c5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5844,6 +5844,8 @@  static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
 	ipt.pt._qproc = io_poll_queue_proc;
 
 	ret = __io_arm_poll_handler(req, &req->poll, &ipt, poll->events);
+	if (!ret && ipt.error)
+		req_set_fail(req);
 	ret = ret ?: ipt.error;
 	if (ret)
 		__io_req_complete(req, issue_flags, ret, 0);