From: Jens Axboe axboe@kernel.dk
stable inclusion from stable-v5.10.214 commit 875f5fed30a182675f729f35bbd6ad62b52bd1ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9P06W CVE: CVE-2023-52656
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Commit a4104821ad651d8a0b374f0b2474c345bbb42f82 upstream.
Since we no longer allow sending io_uring fds over SCM_RIGHTS, move to using io_is_uring_fops() to detect whether this is a io_uring fd or not. With that done, kill off io_uring_get_socket() as nobody calls it anymore.
This is in preparation to yanking out the rest of the core related to unix gc with io_uring.
Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org
Conflicts: include/linux/io_uring.h include/linux/fs.h fs/io_uring.c io_uring/io_uring.c Signed-off-by: Zizhi Wo wozizhi@huawei.com --- fs/io_uring.c | 12 ++---------- include/linux/fs.h | 6 +++--- net/core/scm.c | 2 +- net/unix/scm.c | 4 +--- 4 files changed, 7 insertions(+), 17 deletions(-)
diff --git a/fs/io_uring.c b/fs/io_uring.c index afac3197fd6c..4148912d8380 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -928,18 +928,10 @@ static struct kmem_cache *req_cachep;
static const struct file_operations io_uring_fops;
-struct sock *io_uring_get_socket(struct file *file) +bool io_is_uring_fops(struct file *file) { -#if defined(CONFIG_UNIX) - if (file->f_op == &io_uring_fops) { - struct io_ring_ctx *ctx = file->private_data; - - return ctx->ring_sock->sk; - } -#endif - return NULL; + return file->f_op == &io_uring_fops; } -EXPORT_SYMBOL(io_uring_get_socket);
static void io_get_req_task(struct io_kiocb *req) { diff --git a/include/linux/fs.h b/include/linux/fs.h index 1fad2c5c2fc2..1c9aac073db1 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3593,11 +3593,11 @@ static inline int inode_drain_writes(struct inode *inode) }
#if defined(CONFIG_IO_URING) -extern struct sock *io_uring_get_socket(struct file *file); +extern bool io_is_uring_fops(struct file *file); #else -static inline struct sock *io_uring_get_socket(struct file *file) +static inline bool io_is_uring_fops(struct file *file) { - return NULL; + return false; } #endif
diff --git a/net/core/scm.c b/net/core/scm.c index 4cf9ef6e0250..c71779287649 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -108,7 +108,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) if (fd < 0 || !(file = fget_raw(fd))) return -EBADF; /* don't allow io_uring files */ - if (io_uring_get_socket(file)) { + if (io_is_uring_fops(file)) { fput(file); return -EINVAL; } diff --git a/net/unix/scm.c b/net/unix/scm.c index e881a6e78af5..51b623de3be5 100644 --- a/net/unix/scm.c +++ b/net/unix/scm.c @@ -33,10 +33,8 @@ struct sock *unix_get_socket(struct file *filp) /* PF_UNIX ? */ if (s && sock->ops && sock->ops->family == PF_UNIX) u_sock = s; - } else { - /* Could be an io_uring instance */ - u_sock = io_uring_get_socket(filp); } + return u_sock; } EXPORT_SYMBOL(unix_get_socket);