| From | Stefan Metzmacher <> | Subject | Re: [PATCH 5.4 033/222] io_uring: only allow submit from owning task | Date | Fri, 24 Jan 2020 11:41:16 +0100 |
| |
Am 24.01.20 um 11:38 schrieb Stefan Metzmacher: > Am 22.01.20 um 10:26 schrieb Greg Kroah-Hartman: >> From: Jens Axboe <axboe@kernel.dk> >> >> commit 44d282796f81eb1debc1d7cb53245b4cb3214cb5 upstream. >> >> If the credentials or the mm doesn't match, don't allow the task to >> submit anything on behalf of this ring. The task that owns the ring can >> pass the file descriptor to another task, but we don't want to allow >> that task to submit an SQE that then assumes the ring mm and creds if >> it needs to go async. >> >> Cc: stable@vger.kernel.org >> Suggested-by: Stefan Metzmacher <metze@samba.org> >> Signed-off-by: Jens Axboe <axboe@kernel.dk> >> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> >> >> >> --- >> fs/io_uring.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> --- a/fs/io_uring.c >> +++ b/fs/io_uring.c >> @@ -3716,6 +3716,12 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned >> wake_up(&ctx->sqo_wait); >> submitted = to_submit; >> } else if (to_submit) { >> + if (current->mm != ctx->sqo_mm || >> + current_cred() != ctx->creds) { >> + ret = -EPERM; >> + goto out; >> + } >> + > > I thought about this a bit more. > > I'm not sure if this is actually to restrictive, > because it means applications like Samba won't > be able to use io-uring at all.
Even for simple operations like IORING_OP_READ*, IORING_OP_WRITE*, IORING_OP_FSYNC and IORING_OP_SYNC_FILE_RANGE, which only operate on the given fd.
metze
[unhandled content-type:application/pgp-signature] |