From fc7222c3a9f56271fba02aabbfbae999042f1679 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Thu, 15 Sep 2022 11:44:35 -0600
Subject: [PATCH] io_uring/msg_ring: check file type before putting
Git-commit: fc7222c3a9f56271fba02aabbfbae999042f1679
Patch-mainline: v6.0-rc6
References: bsc#1205205 bsc#1205670 CVE-2022-3910
If we're invoked with a fixed file, follow the normal rules of not
calling io_fput_file(). Fixed files are permanently registered to the
ring, and do not need putting separately.
Cc: stable@vger.kernel.org
Fixes: aa184e8671f0 ("io_uring: don't attempt to IOPOLL for MSG_RING requests")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
fs/io_uring.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4549,7 +4549,8 @@ done:
req_set_fail(req);
__io_req_complete(req, issue_flags, ret, 0);
/* put file to avoid an attempt to IOPOLL the req */
- io_put_file(req->file);
+ if (!(req->flags & REQ_F_FIXED_FILE))
+ io_put_file(req->file);
req->file = NULL;
return 0;
}