Commit fd2206e4 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring: disallow close of ring itself 



A previous commit enabled this functionality, which also enabled O_PATH
to work correctly with io_uring. But we can't safely close the ring
itself, as the file handle isn't reference counted inside
io_uring_enter(). Instead of jumping through hoops to enable ring
closure, add a "soft" ->needs_file option, ->needs_file_no_error. This
enables O_PATH file descriptors to work, but still catches the case of
trying to close the ring itself.

Reported-by: default avatarJann Horn <jannh@google.com>
Fixes: 904fbcb1 ("io_uring: remove 'fd is io_uring' from close path")
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1ee08de1

fs/io_uring.c

+17 −8
Original line number Diff line number Diff line
@@ -698,6 +698,8 @@ struct io_op_def { 
	unsigned		needs_mm : 1;

	/* needs req->file assigned */

	unsigned		needs_file : 1;

	/* don't fail if file grab fails */

	unsigned		needs_file_no_error : 1;

	/* hash wq insertion if file is a regular file */

	unsigned		hash_reg_file : 1;

	/* unbound wq insertion if file is a non-regular file */
@@ -804,6 +806,8 @@ static const struct io_op_def io_op_defs[] = { 
		.needs_fs		= 1,

	},

	[IORING_OP_CLOSE] = {

		.needs_file		= 1,

		.needs_file_no_error	= 1,

		.file_table		= 1,

	},

	[IORING_OP_FILES_UPDATE] = {
@@ -3421,6 +3425,10 @@ static int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 
		return -EBADF;



	req->close.fd = READ_ONCE(sqe->fd);

	if ((req->file && req->file->f_op == &io_uring_fops) ||

	    req->close.fd == req->ctx->ring_fd)

		return -EBADF;



	return 0;

}
@@ -5438,20 +5446,21 @@ static int io_file_get(struct io_submit_state *state, struct io_kiocb *req, 
			return -EBADF;

		fd = array_index_nospec(fd, ctx->nr_user_files);

		file = io_file_from_index(ctx, fd);

		if (!file)

			return -EBADF;

		if (file) {

			req->fixed_file_refs = ctx->file_data->cur_refs;

			percpu_ref_get(req->fixed_file_refs);

		}

	} else {

		trace_io_uring_file_get(ctx, fd);

		file = __io_file_get(state, fd);

		if (unlikely(!file))

			return -EBADF;

	}



	if (file || io_op_defs[req->opcode].needs_file_no_error) {

		*out_file = file;

		return 0;

	}

	return -EBADF;

}



static int io_req_set_file(struct io_submit_state *state, struct io_kiocb *req,

			   int fd)

CRA Git | Maintained and supported by SUSTech CRA and CCSE