diff options
| author | Dylan Yudaken | 2022-04-12 09:30:41 -0700 |
|---|---|---|
| committer | Jens Axboe | 2022-04-12 10:46:54 -0600 |
| commit | 6fb53cf8ff2c4713247df523404d24f466b98f52 (patch) | |
| tree | a19c78dcdb9068b272f4e792fe6ef75500c9f065 /fs | |
| parent | d8a3ba9c143bf89c032deced8a686ffa53b46098 (diff) | |
io_uring: verify resv is 0 in ringfd register/unregister
Only allow resv field to be 0 in struct io_uring_rsrc_update user
arguments.
Fixes: e7a6c00dc77a ("io_uring: add support for registering ring file descriptors")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220412163042.2788062-4-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/io_uring.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index e899192ffb77..a84bfec97d0d 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -10533,6 +10533,11 @@ static int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg, break; } + if (reg.resv) { + ret = -EINVAL; + break; + } + if (reg.offset == -1U) { start = 0; end = IO_RINGFD_REG_MAX; @@ -10579,7 +10584,7 @@ static int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg, ret = -EFAULT; break; } - if (reg.offset >= IO_RINGFD_REG_MAX) { + if (reg.resv || reg.offset >= IO_RINGFD_REG_MAX) { ret = -EINVAL; break; } |