Message ID | 20230405000827.2250965-3-cascardo@canonical.com |
---|---|
State | New |
Headers | show |
Series | CVE-2023-0468 | expand |
diff --git a/fs/io_uring.c b/fs/io_uring.c index 6cb2d435decf..a460204a59f5 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5526,6 +5526,13 @@ static int io_poll_check_events(struct io_kiocb *req, bool locked) return 0; if (v & IO_POLL_CANCEL_FLAG) return -ECANCELED; + /* + * cqe.res contains only events of the first wake up + * and all others are be lost. Redo vfs_poll() to get + * up to date state. + */ + if ((v & IO_POLL_REF_MASK) != 1) + req->result = 0; if (!req->result) { struct poll_table_struct pt = { ._key = poll->events };