Skip to content

Commit d8a3ba9

Browse files
Dylan Yudakenaxboe
authored andcommitted
io_uring: verify that resv2 is 0 in io_uring_rsrc_update2
Verify that the user does not pass in anything but 0 for this field. Fixes: 992da01 ("io_uring: change registration/upd/rsrc tagging ABI") Signed-off-by: Dylan Yudaken <dylany@fb.com> Link: https://lore.kernel.org/r/20220412163042.2788062-3-dylany@fb.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent 565c5e6 commit d8a3ba9

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

fs/io_uring.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6839,6 +6839,7 @@ static int io_files_update(struct io_kiocb *req, unsigned int issue_flags)
68396839
up.nr = 0;
68406840
up.tags = 0;
68416841
up.resv = 0;
6842+
up.resv2 = 0;
68426843

68436844
io_ring_submit_lock(ctx, needs_lock);
68446845
ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE,
@@ -11423,7 +11424,7 @@ static int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg,
1142311424
memset(&up, 0, sizeof(up));
1142411425
if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update)))
1142511426
return -EFAULT;
11426-
if (up.resv)
11427+
if (up.resv || up.resv2)
1142711428
return -EINVAL;
1142811429
return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args);
1142911430
}
@@ -11437,7 +11438,7 @@ static int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg,
1143711438
return -EINVAL;
1143811439
if (copy_from_user(&up, arg, sizeof(up)))
1143911440
return -EFAULT;
11440-
if (!up.nr || up.resv)
11441+
if (!up.nr || up.resv || up.resv2)
1144111442
return -EINVAL;
1144211443
return __io_register_rsrc_update(ctx, type, &up, up.nr);
1144311444
}

0 commit comments

Comments
 (0)