lkml.org 
[lkml]   [2020]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 2/2] io_uring: fix openat/statx's filename leak
    Date
    As in the previous patch, make openat*_prep() and statx_prep() to
    handle double prepartion to avoid resource leakage.

    Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
    ---
    fs/io_uring.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/fs/io_uring.c b/fs/io_uring.c
    index f5aa2fdccf7a..c3bac9d850a5 100644
    --- a/fs/io_uring.c
    +++ b/fs/io_uring.c
    @@ -2536,6 +2536,8 @@ static int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
    return -EINVAL;
    if (sqe->flags & IOSQE_FIXED_FILE)
    return -EINVAL;
    + if (req->flags & REQ_F_NEED_CLEANUP)
    + return 0;

    req->open.dfd = READ_ONCE(sqe->fd);
    req->open.how.mode = READ_ONCE(sqe->len);
    @@ -2564,6 +2566,8 @@ static int io_openat2_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
    return -EINVAL;
    if (sqe->flags & IOSQE_FIXED_FILE)
    return -EINVAL;
    + if (req->flags & REQ_F_NEED_CLEANUP)
    + return 0;

    req->open.dfd = READ_ONCE(sqe->fd);
    fname = u64_to_user_ptr(READ_ONCE(sqe->addr));
    @@ -2763,6 +2767,8 @@ static int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
    return -EINVAL;
    if (sqe->flags & IOSQE_FIXED_FILE)
    return -EINVAL;
    + if (req->flags & REQ_F_NEED_CLEANUP)
    + return 0;

    req->open.dfd = READ_ONCE(sqe->fd);
    req->open.mask = READ_ONCE(sqe->len);
    --
    2.24.0
    \
     
     \ /
      Last update: 2020-02-08 11:31    [W:2.688 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site