iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

io_uring: verify that resv2 is 0 in io_uring_rsrc_update2

Browse Source 
Verify that the user does not pass in anything but 0 for this field.

Fixes: 992da01aa9 ("io_uring: change registration/upd/rsrc tagging ABI")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220412163042.2788062-3-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Dylan Yudaken
2022-04-12 09:30:40 -07:00
committed by Jens Axboe
parent 565c5e616e
commit d8a3ba9c14
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/io_uring.c
View File

@ -6839,6 +6839,7 @@ static int io_files_update(struct io_kiocb *req, unsigned int issue_flags)
up.nr = 0; up.nr = 0;
up.tags = 0; up.tags = 0;
up.resv = 0; up.resv = 0;
up.resv2 = 0;
io_ring_submit_lock(ctx, needs_lock); io_ring_submit_lock(ctx, needs_lock);
ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE, ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE,
@ -11423,7 +11424,7 @@ static int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg,
memset(&up, 0, sizeof(up)); memset(&up, 0, sizeof(up));
if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update))) if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update)))
return -EFAULT; return -EFAULT;
if (up.resv) if (up.resv || up.resv2)
return -EINVAL; return -EINVAL;
return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args); return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args);
} }
@ -11437,7 +11438,7 @@ static int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg,
return -EINVAL; return -EINVAL;
if (copy_from_user(&up, arg, sizeof(up))) if (copy_from_user(&up, arg, sizeof(up)))
return -EFAULT; return -EFAULT;
if (!up.nr || up.resv) if (!up.nr || up.resv || up.resv2)
return -EINVAL; return -EINVAL;
return __io_register_rsrc_update(ctx, type, &up, up.nr); return __io_register_rsrc_update(ctx, type, &up, up.nr);
} }