summaryrefslogtreecommitdiffstats
path: root/fs/io_uring.c
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2021-02-10 20:37:58 +0100
committerJens Axboe <axboe@kernel.dk>2021-02-10 20:37:58 +0100
commit92c75f7594d5060a4cb240f0e987a802f8486b11 (patch)
tree3c21436557ed92c0dbaf8d03d772f527c0817c85 /fs/io_uring.c
parentio_uring: drop mm/files between task_work_submit (diff)
downloadlinux-92c75f7594d5060a4cb240f0e987a802f8486b11.tar.xz
linux-92c75f7594d5060a4cb240f0e987a802f8486b11.zip
Revert "io_uring: don't take fs for recvmsg/sendmsg"
This reverts commit 10cad2c40dcb04bb46b2bf399e00ca5ea93d36b0. Petr reports that with this commit in place, io_uring fails the chroot test (CVE-202-29373). We do need to retain ->fs for send/recvmsg, so revert this commit. Reported-by: Petr Vorel <pvorel@suse.cz> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to '')
-rw-r--r--fs/io_uring.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 1f68105a41ed..931671082e61 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -857,7 +857,8 @@ static const struct io_op_def io_op_defs[] = {
.pollout = 1,
.needs_async_data = 1,
.async_size = sizeof(struct io_async_msghdr),
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FS,
},
[IORING_OP_RECVMSG] = {
.needs_file = 1,
@@ -866,7 +867,8 @@ static const struct io_op_def io_op_defs[] = {
.buffer_select = 1,
.needs_async_data = 1,
.async_size = sizeof(struct io_async_msghdr),
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FS,
},
[IORING_OP_TIMEOUT] = {
.needs_async_data = 1,