From 8ea83461a407dddfd19a751162dedcfbf384aa79 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Sun, 18 Oct 2026 11:43:08 -0400
Subject: [PATCH] MT#55283 prevent racy reuse of poller slots

Closes #2210

Change-Id: If60d1971fc9f313b5fdf2addef4d698b02d22162
(cherry picked from commit 3865f8960d7835db75001326fd003bd1ef30e554)
(cherry picked from commit fa41e202ee4d27c1e233777b113e77e181c8a187)
---
 lib/poller.c | 7 +++++++
 lib/poller.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/lib/poller.c b/lib/poller.c
index 8b1e912db..b6c4158b6 100644
--- a/lib/poller.c
+++ b/lib/poller.c
@@ -31,6 +31,8 @@ struct poller_item_int {
 
 struct poller {
 	int				fd;
+	int32_t				gen;
+	static_assert(sizeof(int) == sizeof(int32_t), "int fd is not 32 bits");
 	mutex_t				lock;
 	GPtrArray			*items;
 };
@@ -117,6 +119,8 @@ bool poller_add_item(struct poller *p, struct poller_item *i) {
 	if (i->u.fd < p->items->len && p->items->pdata[i->u.fd])
 		return false;
 
+	i->u.gen = ++p->gen;
+
 	ZERO(e);
 	e.events = epoll_events(i, NULL);
 	e.data.u64 = i->u.u64;
@@ -215,6 +219,9 @@ static int poller_poll(struct poller *p, int timeout, struct epoll_event *evs, i
 		if (!it)
 			continue;
 
+		if (it->item.u.u64 != u64.u64)
+			continue;
+
 		obj_hold(it);
 		mutex_unlock(&p->lock);
 
diff --git a/lib/poller.h b/lib/poller.h
index bbaf43ab8..c1a477a22 100644
--- a/lib/poller.h
+++ b/lib/poller.h
@@ -27,6 +27,7 @@ typedef void (*poller_func_t)(int, void *);
 union poller_item_u64 {
 	struct {
 		int fd;
+		int32_t gen;
 	} __attribute__((packed));
 	uint64_t u64;
 };