Commit fcba719a authored by Jens Axboe's avatar Jens Axboe Committed by Zizhi Wo
Browse files

io_uring/unix: drop usage of io_uring socket 

stable inclusion
from stable-v5.10.214
commit 875f5fed30a182675f729f35bbd6ad62b52bd1ac
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9P06W
CVE: CVE-2023-52656

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=875f5fed30a182675f729f35bbd6ad62b52bd1ac



--------------------------------

Commit a4104821ad651d8a0b374f0b2474c345bbb42f82 upstream.

Since we no longer allow sending io_uring fds over SCM_RIGHTS, move to
using io_is_uring_fops() to detect whether this is a io_uring fd or not.
With that done, kill off io_uring_get_socket() as nobody calls it
anymore.

This is in preparation to yanking out the rest of the core related to
unix gc with io_uring.

Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>

Conflicts:
	include/linux/io_uring.h
	include/linux/fs.h
	fs/io_uring.c
	io_uring/io_uring.c
Signed-off-by: default avatarZizhi Wo <wozizhi@huawei.com>
parent 5bab8a92

fs/io_uring.c

+2 −10
Original line number Diff line number Diff line
@@ -928,18 +928,10 @@ static struct kmem_cache *req_cachep; 


static const struct file_operations io_uring_fops;



struct sock *io_uring_get_socket(struct file *file)

bool io_is_uring_fops(struct file *file)

{

#if defined(CONFIG_UNIX)

	if (file->f_op == &io_uring_fops) {

		struct io_ring_ctx *ctx = file->private_data;



		return ctx->ring_sock->sk;

	}

#endif

	return NULL;

	return file->f_op == &io_uring_fops;

}

EXPORT_SYMBOL(io_uring_get_socket);



static void io_get_req_task(struct io_kiocb *req)

{

include/linux/fs.h

+3 −3
Original line number Diff line number Diff line
@@ -3593,11 +3593,11 @@ static inline int inode_drain_writes(struct inode *inode) 
}



#if defined(CONFIG_IO_URING)

extern struct sock *io_uring_get_socket(struct file *file);

extern bool io_is_uring_fops(struct file *file);

#else

static inline struct sock *io_uring_get_socket(struct file *file)

static inline bool io_is_uring_fops(struct file *file)

{

	return NULL;

	return false;

}

#endif

net/core/scm.c

+1 −1
Original line number Diff line number Diff line
@@ -108,7 +108,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 
		if (fd < 0 || !(file = fget_raw(fd)))

			return -EBADF;

		/* don't allow io_uring files */

		if (io_uring_get_socket(file)) {

		if (io_is_uring_fops(file)) {

			fput(file);

			return -EINVAL;

		}

net/unix/scm.c

+1 −3
Original line number Diff line number Diff line
@@ -33,10 +33,8 @@ struct sock *unix_get_socket(struct file *filp) 
		/* PF_UNIX ? */

		if (s && sock->ops && sock->ops->family == PF_UNIX)

			u_sock = s;

	} else {

		/* Could be an io_uring instance */

		u_sock = io_uring_get_socket(filp);

	}



	return u_sock;

}

EXPORT_SYMBOL(unix_get_socket);