Commit d8a3ba9c authored by Dylan Yudaken's avatar Dylan Yudaken Committed by Jens Axboe
Browse files

io_uring: verify that resv2 is 0 in io_uring_rsrc_update2 



Verify that the user does not pass in anything but 0 for this field.

Fixes: 992da01a ("io_uring: change registration/upd/rsrc tagging ABI")
Signed-off-by: default avatarDylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220412163042.2788062-3-dylany@fb.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 565c5e61

fs/io_uring.c

+3 −2
Original line number Diff line number Diff line
@@ -6839,6 +6839,7 @@ static int io_files_update(struct io_kiocb *req, unsigned int issue_flags) 
	up.nr = 0;

	up.tags = 0;

	up.resv = 0;

	up.resv2 = 0;



	io_ring_submit_lock(ctx, needs_lock);

	ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE,
@@ -11423,7 +11424,7 @@ static int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg, 
	memset(&up, 0, sizeof(up));

	if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update)))

		return -EFAULT;

	if (up.resv)

	if (up.resv || up.resv2)

		return -EINVAL;

	return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args);

}
@@ -11437,7 +11438,7 @@ static int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg, 
		return -EINVAL;

	if (copy_from_user(&up, arg, sizeof(up)))

		return -EFAULT;

	if (!up.nr || up.resv)

	if (!up.nr || up.resv || up.resv2)

		return -EINVAL;

	return __io_register_rsrc_update(ctx, type, &up, up.nr);

}