From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 19 Sep 2022 17:58:00 +0000 (+0200)
Subject: io_uring: fail links when poll fails
X-Git-Tag: Ubuntu-5.15.0-50.56~4
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=cfb1f1b513004b9d6ab94f33ba67dd282874048c;p=mirror_ubuntu-jammy-kernel.git

io_uring: fail links when poll fails

[ upstream commmit c487a5ad48831afa6784b368ec40d0ee50f2fe1b ]

Don't forget to cancel all linked requests of poll request when
__io_arm_poll_handler() failed.

Fixes: aa43477b04025 ("io_uring: poll rework")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/a78aad962460f9fdfe4aa4c0b62425c88f9415bc.1655852245.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[pavel: backport]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6c7259c83773f22f05159db51ca64d05057259f3 linux-5.15.y)
CVE-2022-3176
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
---

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2dbef0835d51..0a14cb2c55c5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5844,6 +5844,8 @@ static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
 	ipt.pt._qproc = io_poll_queue_proc;
 
 	ret = __io_arm_poll_handler(req, &req->poll, &ipt, poll->events);
+	if (!ret && ipt.error)
+		req_set_fail(req);
 	ret = ret ?: ipt.error;
 	if (ret)
 		__io_req_complete(req, issue_flags, ret, 0);