Commit 92c75f75 authored by Jens Axboe's avatar Jens Axboe
Browse files

Revert "io_uring: don't take fs for recvmsg/sendmsg" 



This reverts commit 10cad2c4.

Petr reports that with this commit in place, io_uring fails the chroot
test (CVE-202-29373). We do need to retain ->fs for send/recvmsg, so
revert this commit.

Reported-by: default avatarPetr Vorel <pvorel@suse.cz>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent aec18a57

fs/io_uring.c

+4 −2
Original line number Diff line number Diff line
@@ -857,7 +857,8 @@ static const struct io_op_def io_op_defs[] = { 
		.pollout		= 1,

		.needs_async_data	= 1,

		.async_size		= sizeof(struct io_async_msghdr),

		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,

		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |

						IO_WQ_WORK_FS,

	},

	[IORING_OP_RECVMSG] = {

		.needs_file		= 1,
@@ -866,7 +867,8 @@ static const struct io_op_def io_op_defs[] = { 
		.buffer_select		= 1,

		.needs_async_data	= 1,

		.async_size		= sizeof(struct io_async_msghdr),

		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,

		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |

						IO_WQ_WORK_FS,

	},

	[IORING_OP_TIMEOUT] = {

		.needs_async_data	= 1,