io_uring: check that data field is 0 in ringfd unregister

[PATCH] io_uring: check that data field is 0 in ringfd unregister

Posted by Eugene Syromiatnikov 4 years ago

Only allow data field to be 0 in struct io_uring_rsrc_update user
arguments to allow for future possible usage.

Fixes: e7a6c00dc77a ("io_uring: add support for registering ring file descriptors")
Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 7625b29..4e32338 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -10588,7 +10588,7 @@ static int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg,
 			ret = -EFAULT;
 			break;
 		}
-		if (reg.resv || reg.offset >= IO_RINGFD_REG_MAX) {
+		if (reg.resv || reg.data || reg.offset >= IO_RINGFD_REG_MAX) {
 			ret = -EINVAL;
 			break;
 		}
-- 
2.1.4

Re: [PATCH] io_uring: check that data field is 0 in ringfd unregister

Posted by Jens Axboe 4 years ago

On Fri, 29 Apr 2022 16:22:18 +0200, Eugene Syromiatnikov wrote:
> Only allow data field to be 0 in struct io_uring_rsrc_update user
> arguments to allow for future possible usage.
> 
> 

Applied, thanks!

[1/1] io_uring: check that data field is 0 in ringfd unregister
      commit: 303cc749c8659d5f1ccf97973591313ec0bdacd3

Best regards,
-- 
Jens Axboe