From: Jens Axboe <axboe@kernel.dk> mainline inclusion from mainline-v6.9-rc1 commit 3cdc4be114a9be61b7041a53e44aa71718a7cf28 category: other bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14112 CVE: CVE-2026-23473 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- This overly long line is hard to read. Break it up by AND'ing the ref mask first, then perform the atomic_sub_return() with the value itself. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- io_uring/poll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/io_uring/poll.c b/io_uring/poll.c index fd6a16d1069e..caa2c5cf88c5 100644 --- a/io_uring/poll.c +++ b/io_uring/poll.c @@ -334,12 +334,12 @@ static int io_poll_check_events(struct io_kiocb *req, struct io_tw_state *ts) /* * Release all references, retry if someone tried to restart * task_work while we were executing it. */ - } while (atomic_sub_return(v & IO_POLL_REF_MASK, &req->poll_refs) & - IO_POLL_REF_MASK); + v &= IO_POLL_REF_MASK; + } while (atomic_sub_return(v, &req->poll_refs) & IO_POLL_REF_MASK); return IOU_POLL_NO_ACTION; } void io_poll_task_func(struct io_kiocb *req, struct io_tw_state *ts) -- 2.39.2