Unverified Commit ace91c88 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4320 io_uring/af_unix: disable sending io_uring over sockets 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KKE372XDDG5Q5OTV7DDRCSDELTXVP2TM/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8RWPE
 
 
Link:https://gitee.com/openeuler/kernel/pulls/4320

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 86fa3a75 942cf9e3

fs/io_uring.c

+0 −49
Original line number Diff line number Diff line
@@ -7220,49 +7220,6 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, 
	return ret;

}



static int io_sqe_file_register(struct io_ring_ctx *ctx, struct file *file,

				int index)

{

#if defined(CONFIG_UNIX)

	struct sock *sock = ctx->ring_sock->sk;

	struct sk_buff_head *head = &sock->sk_receive_queue;

	struct sk_buff *skb;



	/*

	 * See if we can merge this file into an existing skb SCM_RIGHTS

	 * file set. If there's no room, fall back to allocating a new skb

	 * and filling it in.

	 */

	spin_lock_irq(&head->lock);

	skb = skb_peek(head);

	if (skb) {

		struct scm_fp_list *fpl = UNIXCB(skb).fp;



		if (fpl->count < SCM_MAX_FD) {

			__skb_unlink(skb, head);

			spin_unlock_irq(&head->lock);

			fpl->fp[fpl->count] = get_file(file);

			unix_inflight(fpl->user, fpl->fp[fpl->count]);

			fpl->count++;

			spin_lock_irq(&head->lock);

			__skb_queue_head(head, skb);

		} else {

			skb = NULL;

		}

	}

	spin_unlock_irq(&head->lock);



	if (skb) {

		fput(file);

		return 0;

	}



	return __io_sqe_files_scm(ctx, 1, index);

#else

	return 0;

#endif

}



static int io_queue_file_removal(struct fixed_file_data *data,

				 struct file *file)

{
@@ -7342,12 +7299,6 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, 
				break;

			}

			table->files[index] = file;

			err = io_sqe_file_register(ctx, file, i);

			if (err) {

				table->files[index] = NULL;

				fput(file);

				break;

			}

		}

		nr_args--;

		done++;

net/core/scm.c

+6 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ 
#include <linux/pid.h>

#include <linux/nsproxy.h>

#include <linux/slab.h>

#include <linux/fs.h>



#include <linux/uaccess.h>
@@ -106,6 +107,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 


		if (fd < 0 || !(file = fget_raw(fd)))

			return -EBADF;

		/* don't allow io_uring files */

		if (io_uring_get_socket(file)) {

			fput(file);

			return -EINVAL;

		}

		*fpp++ = file;

		fpl->count++;

	}