January 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] sched: remove __GENKSYMS__ used
by Yipeng Zou 30 Jan '24

30 Jan '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZTTF CVE: NA -------------------------------- Don't use GENKSYMS in baseline kabi version: Fixes: 6eb07f9925a9 ("sched: Introduce smart grid scheduling strateg for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- include/linux/sched.h | 2 +- kernel/sched/sched.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 4f18d4505618..e08f02706615 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1560,7 +1560,7 @@ struct task_struct { int memstall_type; #endif -#if defined(CONFIG_QOS_SCHED_SMART_GRID) && !defined(__GENKSYMS__) +#if defined(CONFIG_QOS_SCHED_SMART_GRID) struct sched_grid_qos *grid_qos; #endif diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 88dbcbe3d7c1..c3b8d871f66e 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -452,7 +452,7 @@ struct task_group { long tag; #endif -#if defined(CONFIG_QOS_SCHED_SMART_GRID) && !defined(__GENKSYMS__) +#if defined(CONFIG_QOS_SCHED_SMART_GRID) struct auto_affinity *auto_affinity; #endif }; -- 2.34.1

2 1

[PATCH OLK-6.6] block: reserve kabi space for general block layer structures
by Yu Kuai 30 Jan '24

30 Jan '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZW7Z CVE: NA -------------------------------- struture size reserves bio_integrity_payload 136 4 bio_set 944 10 blk_integrity_profile 40 3 request dynamic 8 blk_mq_hw_ctx 704 8 blk_mq_tag_set 280 5 blk_mq_queue_data 16 2 blk_mq_ops 144 6 blk_mq_tags 240 10 rq_map_data 24 1 block_device 1616 6 bio dynamic 8 blk_integrity 16 2 gendisk 1568 12 queue_limits 120 9 blk_independent_access_range 80 6 blk_independent_access_ranges 72 7 request_queue 2088 12 blk_plug 40 3 block_device_operations 144 6 blk_holder_ops 16 6 io_comp_batch 24 1 Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- include/linux/bio.h | 18 +++++++++ include/linux/blk-integrity.h | 4 ++ include/linux/blk-mq.h | 47 ++++++++++++++++++++++ include/linux/blk_types.h | 17 ++++++++ include/linux/blkdev.h | 75 +++++++++++++++++++++++++++++++++++ 5 files changed, 161 insertions(+) diff --git a/include/linux/bio.h b/include/linux/bio.h index 41d417ee1349..d7510212701c 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -9,6 +9,7 @@ /* struct bio, bio_vec and BIO_* flags are defined in blk_types.h */ #include <linux/blk_types.h> #include <linux/uio.h> +#include <linux/kabi.h> #define BIO_MAX_VECS 256U @@ -343,6 +344,12 @@ struct bio_integrity_payload { struct work_struct bip_work; /* I/O completion */ struct bio_vec *bip_vec; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + struct bio_vec bip_inline_vecs[];/* embedded bvec array */ }; @@ -702,6 +709,17 @@ struct bio_set { * Hot un-plug notifier for the per-cpu cache, if used */ struct hlist_node cpuhp_dead; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) }; static inline bool bioset_initialized(struct bio_set *bs) diff --git a/include/linux/blk-integrity.h b/include/linux/blk-integrity.h index 378b2459efe2..1eec355e999b 100644 --- a/include/linux/blk-integrity.h +++ b/include/linux/blk-integrity.h @@ -33,6 +33,10 @@ struct blk_integrity_profile { integrity_prepare_fn *prepare_fn; integrity_complete_fn *complete_fn; const char *name; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) }; #ifdef CONFIG_BLK_DEV_INTEGRITY diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 9dfee0644f9c..f6de4543a653 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -189,6 +189,15 @@ struct request { */ rq_end_io_fn *end_io; void *end_io_data; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; static inline enum req_op req_op(const struct request *req) @@ -430,6 +439,15 @@ struct blk_mq_hw_ctx { * q->unused_hctx_list. */ struct list_head hctx_list; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; /** @@ -516,6 +534,12 @@ struct blk_mq_tag_set { struct mutex tag_list_lock; struct list_head tag_list; struct srcu_struct *srcu; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) }; /** @@ -527,6 +551,9 @@ struct blk_mq_tag_set { struct blk_mq_queue_data { struct request *rq; bool last; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; typedef bool (busy_tag_iter_fn)(struct request *, void *); @@ -646,6 +673,13 @@ struct blk_mq_ops { */ void (*show_rq)(struct seq_file *m, struct request *rq); #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; enum { @@ -751,6 +785,17 @@ struct blk_mq_tags { * request pool */ spinlock_t lock; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) }; static inline struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, @@ -985,6 +1030,8 @@ struct rq_map_data { unsigned short nr_entries; bool null_mapped; bool from_user; + + KABI_RESERVE(1) }; int blk_rq_map_user(struct request_queue *, struct request *, diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index f571b45eba19..972237b32fbd 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -78,6 +78,13 @@ struct block_device { * path */ struct device bd_device; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) } __randomize_layout; #define bdev_whole(_bdev) \ @@ -319,6 +326,16 @@ struct bio { struct bio_set *bi_pool; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + /* * We can inline a number of vecs at the end of the bio, to avoid * double allocations for a small number of bio_vecs. This member diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index d8a0ee46ba37..2a88b0ef3270 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -110,6 +110,9 @@ struct blk_integrity { unsigned char tuple_size; unsigned char interval_exp; unsigned char tag_size; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; typedef unsigned int __bitwise blk_mode_t; @@ -211,6 +214,19 @@ struct gendisk { * devices that do not have multiple independent access ranges. */ struct blk_independent_access_ranges *ia_ranges; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) }; static inline bool disk_live(struct gendisk *disk) @@ -328,6 +344,16 @@ struct queue_limits { * due to possible offsets. */ unsigned int dma_alignment; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) }; typedef int (*report_zones_cb)(struct blk_zone *zone, unsigned int idx, @@ -370,12 +396,28 @@ struct blk_independent_access_range { struct kobject kobj; sector_t sector; sector_t nr_sectors; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; struct blk_independent_access_ranges { struct kobject kobj; bool sysfs_registered; unsigned int nr_ia_ranges; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + struct blk_independent_access_range ia_range[]; }; @@ -527,6 +569,19 @@ struct request_queue { struct mutex debugfs_mutex; bool mq_sysfs_init_done; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) }; /* Keep blk_queue_flag_name[] in sync with the definitions below */ @@ -980,6 +1035,10 @@ struct blk_plug { bool has_elevator; struct list_head cb_list; /* md requires an unplug callback */ + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) }; struct blk_plug_cb; @@ -1412,6 +1471,13 @@ struct block_device_operations { * driver. */ int (*alternative_gpt_sector)(struct gendisk *disk, sector_t *sector); + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; #ifdef CONFIG_COMPAT @@ -1475,6 +1541,13 @@ struct blk_holder_ops { * Sync the file system mounted on the block device. */ void (*sync)(struct block_device *bdev); + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) }; extern const struct blk_holder_ops fs_holder_ops; @@ -1551,6 +1624,8 @@ struct io_comp_batch { struct request *req_list; bool need_ts; void (*complete)(struct io_comp_batch *); + + KABI_RESERVE(1) }; #define DEFINE_IO_COMP_BATCH(name) struct io_comp_batch name = { } -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Introduce NEON implementation of crct10dif
by GUO Zihua 30 Jan '24

30 Jan '24

This patchset introduces NEON implementation of crct10dif. It is proven to be more efficient on users' environments. The first patch also contains content of the following patches: commit 8a0f79692179 ("crypto: Add PMULL judgment during initialization to prevent oops") commit cc86358ae321 ("crypto: crct10dif-neon - fix use via crypto_shash_digest()") GUO Zihua (1): arm64/crypto: Introduce individual config for CRCT10DIF-NEON algorithm YueHaibing (1): arm64/crypto: Accelerated CRC T10 DIF computation arch/arm64/crypto/Kconfig | 10 + arch/arm64/crypto/Makefile | 4 + arch/arm64/crypto/crct10dif-neon-asm_64.S | 752 ++++++++++++++++++++++ arch/arm64/crypto/crct10dif-neon_glue.c | 118 ++++ 4 files changed, 884 insertions(+) create mode 100644 arch/arm64/crypto/crct10dif-neon-asm_64.S create mode 100644 arch/arm64/crypto/crct10dif-neon_glue.c -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] KABI: Add reserve space for sched structures
by Zheng Zucheng 30 Jan '24

30 Jan '24

From: Guan Jing <guanjing6(a)huawei.com> KABI: Add reserve space for sched structures Guan Jing (2): KABI: Add reserve space for sched structures fork: Allocate a new task_struct_resvd object for fork task include/linux/fwnode.h | 7 +++++++ include/linux/module.h | 4 ++++ include/linux/sched.h | 30 ++++++++++++++++++++++++++++++ include/linux/sched/signal.h | 5 +++++ init/init_task.c | 5 +++++ kernel/fork.c | 21 ++++++++++++++++++++- kernel/sched/sched.h | 35 ++++++++++++++++++++++++++++++++++- 7 files changed, 105 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] reserve KABI slots for file system or Storage related structures
by ZhaoLong Wang 30 Jan '24

30 Jan '24

Reserve kabi slots for the following structures: - export_operations - pipe_inode_info - mtd_info - mtd_part_parser_data - mtd_partition ZhaoLong Wang (3): exportfs: kabi: Reserve KABI slots for export_operations structure pipe: kabi: Reserve KABI slots for pipe_inode_info structure mtd: kabi: Reserve KABI slots for mtd_device_xxx_register() related structures include/linux/exportfs.h | 3 +++ include/linux/mtd/mtd.h | 3 +++ include/linux/mtd/partitions.h | 6 +++++- include/linux/pipe_fs_i.h | 4 ++++ 4 files changed, 15 insertions(+), 1 deletion(-) -- 2.34.3

2 4

[PATCH v2 OLK-6.6 00/20] kabi reserve patches
by Lin Yujun 30 Jan '24

30 Jan '24

*** BLURB HERE *** Chen Jiahao (1): KABI: reserve space for struct input_dev Lin Ruizhe (5): msi: Add kabi_reserve in msi.h interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain Lin Yujun (13): drm: drm_atomic.h: Add kabi_reserve drm: drm_client.h: Add kabi_reserve drm: drm_connector.h: Add kabi_reserve drm: drm_crtc.h: Add kabi_reserve drm: drm_device.h: Add kabi_reserve drm: drm_drv.h: Add kabi_reserve drm: drm_fb_helper.h: Add kabi_reserve drm: drm_file.h: Add kabi_reserve drm: drm_fourcc.h: Add kabi_reserve drm: drm_gem.h: Add kabi_reserve pm: pm_domain.h: Add kabi_reserve pm: pm.h: Add kabi_reserve energy_model: Add kabi_reserve Yang Yingliang (1): kabi: reserve space for struct cpu_stop_work include/drm/drm_atomic.h | 6 ++++++ include/drm/drm_client.h | 7 +++++++ include/drm/drm_connector.h | 18 ++++++++++++++++++ include/drm/drm_crtc.h | 7 +++++++ include/drm/drm_device.h | 4 ++++ include/drm/drm_drv.h | 5 +++++ include/drm/drm_fb_helper.h | 8 ++++++++ include/drm/drm_file.h | 8 ++++++++ include/drm/drm_fourcc.h | 5 +++++ include/drm/drm_gem.h | 8 ++++++++ include/linux/energy_model.h | 5 +++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 6 ++++++ include/linux/irq.h | 8 ++++++++ include/linux/irqdesc.h | 4 +++- include/linux/irqdomain.h | 3 +++ include/linux/msi.h | 7 +++++++ include/linux/pm.h | 11 +++++++++++ include/linux/pm_domain.h | 6 ++++++ include/linux/stop_machine.h | 3 +++ 20 files changed, 132 insertions(+), 1 deletion(-) -- 2.34.1

1 20

[PATCH v2 PATCH OLK-6.6 00/20] kabi reserve patches
by Lin Yujun 30 Jan '24

30 Jan '24

*** BLURB HERE *** Chen Jiahao (1): KABI: reserve space for struct input_dev Lin Ruizhe (5): msi: Add kabi_reserve in msi.h interrupt: Add kabi_reserve in interrupt.h irq: Add kabi_reserve in irq irq_desc: Add kabi_reserve in irq_desc irqdomain: Add kabi_reserve in irqdomain Lin Yujun (13): drm: drm_atomic.h: Add kabi_reserve drm: drm_client.h: Add kabi_reserve drm: drm_connector.h: Add kabi_reserve drm: drm_crtc.h: Add kabi_reserve drm: drm_device.h: Add kabi_reserve drm: drm_drv.h: Add kabi_reserve drm: drm_fb_helper.h: Add kabi_reserve drm: drm_file.h: Add kabi_reserve drm: drm_fourcc.h: Add kabi_reserve drm: drm_gem.h: Add kabi_reserve pm: pm_domain.h: Add kabi_reserve pm: pm.h: Add kabi_reserve energy_model: Add kabi_reserve Yang Yingliang (1): kabi: reserve space for struct cpu_stop_work include/drm/drm_atomic.h | 6 ++++++ include/drm/drm_client.h | 7 +++++++ include/drm/drm_connector.h | 18 ++++++++++++++++++ include/drm/drm_crtc.h | 7 +++++++ include/drm/drm_device.h | 4 ++++ include/drm/drm_drv.h | 5 +++++ include/drm/drm_fb_helper.h | 8 ++++++++ include/drm/drm_file.h | 8 ++++++++ include/drm/drm_fourcc.h | 5 +++++ include/drm/drm_gem.h | 8 ++++++++ include/linux/energy_model.h | 5 +++++ include/linux/input.h | 4 ++++ include/linux/interrupt.h | 6 ++++++ include/linux/irq.h | 8 ++++++++ include/linux/irqdesc.h | 4 +++- include/linux/irqdomain.h | 3 +++ include/linux/msi.h | 7 +++++++ include/linux/pm.h | 11 +++++++++++ include/linux/pm_domain.h | 6 ++++++ include/linux/stop_machine.h | 3 +++ 20 files changed, 132 insertions(+), 1 deletion(-) -- 2.34.1

1 20

[PATCH OLK-5.10] sched: remove __GENKSYMS__ used
by Yipeng Zou 30 Jan '24

30 Jan '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZTTF CVE: NA -------------------------------- There is no need use __GENKSYMS__. Fixes: 00d37128abe2 ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- include/linux/sched.h | 5 +---- kernel/sched/sched.h | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 8ccbca99ace1..4688bd8a44aa 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1450,15 +1450,12 @@ struct task_struct { KABI_RESERVE(11) #endif -#if !defined(__GENKSYMS__) #if defined(CONFIG_QOS_SCHED_SMART_GRID) struct sched_grid_qos *grid_qos; #else KABI_RESERVE(12) #endif -#else - KABI_RESERVE(12) -#endif + #ifdef CONFIG_PSI_FINE_GRAINED KABI_USE(13, int memstall_type) #else diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 18c1b3d5a378..1044664bccfa 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -500,7 +500,7 @@ struct task_group { #else KABI_RESERVE(3) #endif -#if defined(CONFIG_QOS_SCHED_SMART_GRID) && !defined(__GENKSYMS__) +#if defined(CONFIG_QOS_SCHED_SMART_GRID) KABI_USE(4, struct auto_affinity *auto_affinity) #else KABI_RESERVE(4) -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] cgroup_writeback: fix deadlock
by Chen Ridong 30 Jan '24

30 Jan '24

Lu Jialin (1): cgroup_writeback: fix deadlock in cgroup1_writeback mm/backing-dev.c | 2 -- mm/memcontrol.c | 21 +++++++++++++++------ 2 files changed, 15 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] io_uring/af_unix: disable sending io_uring over sockets
by Liu Jian 30 Jan '24

30 Jan '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v5.10.204 commit 3fe1ea5f921bf5b71cbfdc4469fb96c05936610e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8RWPE CVE: CVE-2023-6531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 upstream. File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary. Cc: <stable(a)vger.kernel.org> Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release") Reported-and-suggested-by: Jann Horn <jannh(a)google.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/c716c88321939156909cfa1bd8b0faaf1c804103.17018687… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [cherry-pick the cve bugfix from 5.10-stable] Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: io_uring/io_uring.c net/core/scm.c --- fs/io_uring.c | 49 ------------------------------------------------- net/core/scm.c | 6 ++++++ 2 files changed, 6 insertions(+), 49 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 88eca93c55b7..018d38bec473 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7220,49 +7220,6 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, return ret; } -static int io_sqe_file_register(struct io_ring_ctx *ctx, struct file *file, - int index) -{ -#if defined(CONFIG_UNIX) - struct sock *sock = ctx->ring_sock->sk; - struct sk_buff_head *head = &sock->sk_receive_queue; - struct sk_buff *skb; - - /* - * See if we can merge this file into an existing skb SCM_RIGHTS - * file set. If there's no room, fall back to allocating a new skb - * and filling it in. - */ - spin_lock_irq(&head->lock); - skb = skb_peek(head); - if (skb) { - struct scm_fp_list *fpl = UNIXCB(skb).fp; - - if (fpl->count < SCM_MAX_FD) { - __skb_unlink(skb, head); - spin_unlock_irq(&head->lock); - fpl->fp[fpl->count] = get_file(file); - unix_inflight(fpl->user, fpl->fp[fpl->count]); - fpl->count++; - spin_lock_irq(&head->lock); - __skb_queue_head(head, skb); - } else { - skb = NULL; - } - } - spin_unlock_irq(&head->lock); - - if (skb) { - fput(file); - return 0; - } - - return __io_sqe_files_scm(ctx, 1, index); -#else - return 0; -#endif -} - static int io_queue_file_removal(struct fixed_file_data *data, struct file *file) { @@ -7342,12 +7299,6 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, break; } table->files[index] = file; - err = io_sqe_file_register(ctx, file, i); - if (err) { - table->files[index] = NULL; - fput(file); - break; - } } nr_args--; done++; diff --git a/net/core/scm.c b/net/core/scm.c index b1ff8a441748..4cf9ef6e0250 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -29,6 +29,7 @@ #include <linux/pid.h> #include <linux/nsproxy.h> #include <linux/slab.h> +#include <linux/fs.h> #include <linux/uaccess.h> @@ -106,6 +107,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) if (fd < 0 || !(file = fget_raw(fd))) return -EBADF; + /* don't allow io_uring files */ + if (io_uring_get_socket(file)) { + fput(file); + return -EINVAL; + } *fpp++ = file; fpl->count++; } -- 2.34.1

1 0