Commit ebf4a5db authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix leaving invalid req->flags 



sqe->flags are subset of req flags, so incorrectly copied may span into
in-kernel flags and wreck havoc, e.g. by setting REQ_F_INFLIGHT.

Fixes: 5be9ad1e ("io_uring: optimise io_init_req() flags setting")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 88f171ab

fs/io_uring.c

+3 −1
Original line number Diff line number Diff line
@@ -6679,8 +6679,10 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 
	req->result = 0;



	/* enforce forwards compatibility on users */

	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS))

	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) {

		req->flags = 0;

		return -EINVAL;

	}



	if (unlikely(req->opcode >= IORING_OP_LAST))

		return -EINVAL;