lkml.org 
[lkml]   [2022]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 111/219] io_uring: verify that resv2 is 0 in io_uring_rsrc_update2
    Date
    From: Dylan Yudaken <dylany@fb.com>

    [ Upstream commit d8a3ba9c143bf89c032deced8a686ffa53b46098 ]

    Verify that the user does not pass in anything but 0 for this field.

    Fixes: 992da01aa932 ("io_uring: change registration/upd/rsrc tagging ABI")
    Signed-off-by: Dylan Yudaken <dylany@fb.com>
    Link: https://lore.kernel.org/r/20220412163042.2788062-3-dylany@fb.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/io_uring.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/fs/io_uring.c b/fs/io_uring.c
    index 7da6fddaef4d..2838bc6cdbc8 100644
    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -6466,6 +6466,7 @@ static int io_files_update(struct io_kiocb *req, unsigned int issue_flags)
    up.nr = 0;
    up.tags = 0;
    up.resv = 0;
    + up.resv2 = 0;

    io_ring_submit_lock(ctx, needs_lock);
    ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE,
    @@ -10809,7 +10810,7 @@ static int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg,
    memset(&up, 0, sizeof(up));
    if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update)))
    return -EFAULT;
    - if (up.resv)
    + if (up.resv || up.resv2)
    return -EINVAL;
    return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args);
    }
    @@ -10823,7 +10824,7 @@ static int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg,
    return -EINVAL;
    if (copy_from_user(&up, arg, sizeof(up)))
    return -EFAULT;
    - if (!up.nr || up.resv)
    + if (!up.nr || up.resv || up.resv2)
    return -EINVAL;
    return __io_register_rsrc_update(ctx, type, &up, up.nr);
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-04-18 14:30    [W:2.036 / U:0.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site