From: Ming Lei Date: Fri, 10 May 2024 03:50:27 +0000 (+0800) Subject: io_uring: fail NOP if non-zero op flags is passed in X-Git-Tag: v5.10.219~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b6920325aca03138ef9ba759ce0d4e6fbb5c9763;p=thirdparty%2Fkernel%2Fstable.git io_uring: fail NOP if non-zero op flags is passed in commit 3d8f874bd620ce03f75a5512847586828ab86544 upstream. The NOP op flags should have been checked from beginning like any other opcode, otherwise NOP may not be extended with the op flags. Given both liburing and Rust io-uring crate always zeros SQE op flags, just ignore users which play raw NOP uring interface without zeroing SQE, because NOP is just for test purpose. Then we can save one NOP2 opcode. Suggested-by: Jens Axboe Fixes: 2b188cc1bb85 ("Add io_uring IO interface") Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20240510035031.78874-2-ming.lei@redhat.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 93f9ecedc59f6..47bc8fe2b9452 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -6474,6 +6474,8 @@ static int io_req_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { switch (req->opcode) { case IORING_OP_NOP: + if (READ_ONCE(sqe->rw_flags)) + return -EINVAL; return 0; case IORING_OP_READV: case IORING_OP_READ_FIXED: