io_uring/net: don't retry connect operation on EPOLLERR

commit 8c8492ca64e79c6e0f433e8c9d2bcbd039ef83d0 upstream.

If a socket is shutdown before the connection completes, POLLERR is set
in the poll mask. However, connect ignores this as it doesn't know, and
attempts the connection again. This may lead to a bogus -ETIMEDOUT
result, where it should have noticed the POLLERR and just returned
-ECONNRESET instead.

Have the poll logic check for whether or not POLLERR is set in the mask,
and if so, mark the request as failed. Then connect can appropriately
fail the request rather than retry it.

Reported-by: Sergey Galas <ssgalas@cloud.ru>
Cc: stable@vger.kernel.org
Link: https://github.com/axboe/liburing/discussions/1335
Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/net.c b/io_uring/net.c
index f41acabf7b4a54d7d163885db94ce31ba7ca2f32..dc7c1e44ec47b793e2e5803d2240d52e6102b054 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1486,6 +1486,11 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
                io = &__io;
        }
 
+       if (unlikely(req->flags & REQ_F_FAIL)) {
+               ret = -ECONNRESET;
+               goto out;
+       }
+
        file_flags = force_nonblock ? O_NONBLOCK : 0;
 
        ret = __sys_connect_file(req->file, &io->address,

diff --git a/io_uring/poll.c b/io_uring/poll.c
index a4084acaff911648b1657457ae8f61bb9a91d85a..428f84ed1021650e23b93f50703a025ca94c375f 100644 (file)
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -288,6 +288,8 @@ static int io_poll_check_events(struct io_kiocb *req, bool *locked)
                                return IOU_POLL_REISSUE;
                        }
                }
+               if (unlikely(req->cqe.res & EPOLLERR))
+                       req_set_fail(req);
                if (req->apoll_events & EPOLLONESHOT)
                        return IOU_POLL_DONE;
                if (io_is_uring_fops(req->file))