Commit cced1c5e authored Jan 26, 2024 by Linus Torvalds

Merge tag 'io_uring-6.8-2024-01-26' of git://git.kernel.dk/linux

Pull io_uring fix from Jens Axboe:
 "Just a single tweak to the newly added IORING_OP_FIXED_FD_INSTALL from
  Paul, ensuring it goes via the audit path and playing it safe by
  excluding it from using registered creds"

* tag 'io_uring-6.8-2024-01-26' of git://git.kernel.dk/linux:
  io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

parents 667c8893 16bae3e1

io_uring/opdef.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -471,7 +471,6 @@ const struct io_issue_def io_issue_defs[] = {
		},
		[IORING_OP_FIXED_FD_INSTALL] = {
		.needs_file = 1,
		.audit_skip = 1,
		.prep = io_install_fixed_fd_prep,
		.issue = io_install_fixed_fd,
		},

io_uring/openclose.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -277,6 +277,10 @@ int io_install_fixed_fd_prep(struct io_kiocb req, const struct io_uring_sqe sq
		if (flags & ~IORING_FIXED_FD_NO_CLOEXEC)
		return -EINVAL;

		/* ensure the task's creds are used when installing/receiving fds */
		if (req->flags & REQ_F_CREDS)
		return -EPERM;

		/* default to O_CLOEXEC, disable if IORING_FIXED_FD_NO_CLOEXEC is set */
		ifi = io_kiocb_to_cmd(req, struct io_fixed_install);
		ifi->o_flags = O_CLOEXEC;