Commit 69db702c authored by Pavel Begunkov's avatar Pavel Begunkov Committed by David S. Miller
Browse files

io_uring/af_unix: disable sending io_uring over sockets 



File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.

Cc: stable@vger.kernel.org
Fixes: 0091bfc8 ("io_uring/af_unix: defer registered files gc to io_uring release")
Reported-and-suggested-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 15319a4e

io_uring/rsrc.h

+0 −7
Original line number Diff line number Diff line
@@ -77,17 +77,10 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, 


int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file);



#if defined(CONFIG_UNIX)

static inline bool io_file_need_scm(struct file *filp)

{

	return !!unix_get_socket(filp);

}

#else

static inline bool io_file_need_scm(struct file *filp)

{

	return false;

}

#endif



static inline int io_scm_file_account(struct io_ring_ctx *ctx,

				      struct file *file)

net/core/scm.c

+6 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/nsproxy.h>

#include <linux/slab.h>

#include <linux/errqueue.h>

#include <linux/io_uring.h>



#include <linux/uaccess.h>
@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 


		if (fd < 0 || !(file = fget_raw(fd)))

			return -EBADF;

		/* don't allow io_uring files */

		if (io_uring_get_socket(file)) {

			fput(file);

			return -EINVAL;

		}

		*fpp++ = file;

		fpl->count++;

	}