libkcapi/007-CVE-2026-71227.patch
Zoltan Fridrich 29135cdfc5 Fix CVE-2026-71227
Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all()
due to unhandled io_getevents() timeout return

Resolves: RHEL-224975

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
2026-08-18 12:49:14 +02:00

23 lines
653 B
Diff

diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
index 8a12c09..a54cdaa 100644
--- a/lib/kcapi-kernel-if.c
+++ b/lib/kcapi-kernel-if.c
@@ -436,6 +436,8 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
if (rc < 0)
return err == 0 ? rc : err;
+ if (rc == 0)
+ return err == 0 ? -ETIMEDOUT : err;
for (i = 0; i < rc; i++) {
struct iocb *cb;
@@ -509,7 +511,7 @@ int _kcapi_aio_read_iov(struct kcapi_handle *handle,
timeout.tv_sec = 0;
timeout.tv_nsec = 10000;
ret = _kcapi_aio_read_all(handle, iovlen, &timeout);
- if (ret < 0)
+ if (ret < 0 && ret != -ETIMEDOUT)
return ret;
}