io_uring: fix compat for IORING_REGISTER_FILES_UPDATE (1292e972) · Commits · 戴 / test

fds field of struct io_uring_files_update is problematic with regards to compat user space, as pointer size is different in 32-bit, 32-on-64-bit, and 64-bit user space. In order to avoid custom handling of compat in the syscall implementation, make fds __u64 and use u64_to_user_ptr in order to retrieve it. Also, align the field naturally and check that no garbage is passed there. Fixes: ("io_uring: add support for IORING_REGISTER_FILES_UPDATE") Signed-off-by:

Eugene Syromiatnikov <esyr@redhat.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

fs/io_uring.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -4463,13 +4463,15 @@ static int io_sqe_files_update(struct io_ring_ctx ctx, void __user arg,
		return -EINVAL;
		if (copy_from_user(&up, arg, sizeof(up)))
		return -EFAULT;
		if (up.resv)
		return -EINVAL;
		if (check_add_overflow(up.offset, nr_args, &done))
		return -EOVERFLOW;
		if (done > ctx->nr_user_files)
		return -EINVAL;

		done = 0;
		fds = (__s32 __user *) up.fds;
		fds = u64_to_user_ptr(up.fds);
		while (nr_args) {
		struct fixed_file_table *table;
		unsigned index;

include/uapi/linux/io_uring.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -178,7 +178,8 @@ struct io_uring_params {

		struct io_uring_files_update {
		__u32 offset;
		__s32 *fds;
		__u32 resv;
		__aligned_u64 /* __s32 * */ fds;
		};

		#endif

Admin message