Skip to content

Commit 6fb53cf

Browse files
Dylan Yudakenaxboe
authored andcommitted
io_uring: verify resv is 0 in ringfd register/unregister
Only allow resv field to be 0 in struct io_uring_rsrc_update user arguments. Fixes: e7a6c00 ("io_uring: add support for registering ring file descriptors") Signed-off-by: Dylan Yudaken <dylany@fb.com> Link: https://lore.kernel.org/r/20220412163042.2788062-4-dylany@fb.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent d8a3ba9 commit 6fb53cf

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

fs/io_uring.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10533,6 +10533,11 @@ static int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg,
1053310533
break;
1053410534
}
1053510535

10536+
if (reg.resv) {
10537+
ret = -EINVAL;
10538+
break;
10539+
}
10540+
1053610541
if (reg.offset == -1U) {
1053710542
start = 0;
1053810543
end = IO_RINGFD_REG_MAX;
@@ -10579,7 +10584,7 @@ static int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg,
1057910584
ret = -EFAULT;
1058010585
break;
1058110586
}
10582-
if (reg.offset >= IO_RINGFD_REG_MAX) {
10587+
if (reg.resv || reg.offset >= IO_RINGFD_REG_MAX) {
1058310588
ret = -EINVAL;
1058410589
break;
1058510590
}

0 commit comments

Comments
 (0)