Commit 63b7b3ea authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-5.18-2022-04-29' of git://git.kernel.dk/linux-block 

Pull io_uring fixes from Jens Axboe:
 "Pretty boring:

   - three patches just adding reserved field checks (me, Eugene)

   - Fixing a potential regression with IOPOLL caused by a block change
     (Joseph)"

Boring is good.

* tag 'io_uring-5.18-2022-04-29' of git://git.kernel.dk/linux-block:
  io_uring: check that data field is 0 in ringfd unregister
  io_uring: fix uninitialized field in rw io_kiocb
  io_uring: check reserved fields for recv/recvmsg
  io_uring: check reserved fields for send/sendmsg
parents bdda8303 303cc749

fs/io_uring.c

+6 −1
Original line number Diff line number Diff line
@@ -3783,6 +3783,7 @@ static int io_rw_init_file(struct io_kiocb *req, fmode_t mode) 
		if (!(kiocb->ki_flags & IOCB_DIRECT) || !file->f_op->iopoll)

			return -EOPNOTSUPP;



		kiocb->private = NULL;

		kiocb->ki_flags |= IOCB_HIPRI | IOCB_ALLOC_CACHE;

		kiocb->ki_complete = io_complete_rw_iopoll;

		req->iopoll_completed = 0;
@@ -5207,6 +5208,8 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 


	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))

		return -EINVAL;

	if (unlikely(sqe->addr2 || sqe->file_index))

		return -EINVAL;



	sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));

	sr->len = READ_ONCE(sqe->len);
@@ -5418,6 +5421,8 @@ static int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 


	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))

		return -EINVAL;

	if (unlikely(sqe->addr2 || sqe->file_index))

		return -EINVAL;



	sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));

	sr->len = READ_ONCE(sqe->len);
@@ -10588,7 +10593,7 @@ static int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg, 
			ret = -EFAULT;

			break;

		}

		if (reg.resv || reg.offset >= IO_RINGFD_REG_MAX) {

		if (reg.resv || reg.data || reg.offset >= IO_RINGFD_REG_MAX) {

			ret = -EINVAL;

			break;

		}