From: Goldwyn Rodrigues <rgoldwyn@xxxxxxxx> aio_flags are not checked when performing io_submit() and can contain non-conforming values. Return -EINVAL if they are invalid. Signed-off-by: Goldwyn Rodrigues <rgoldwyn@xxxxxxxx> diff --git a/fs/aio.c b/fs/aio.c index 428484f..f2dd175 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1521,6 +1521,11 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb, return -EINVAL; } + if (unlikely(iocb->aio_flags & ~IOCB_FLAG_RESFD)) { + pr_debug("EINVAL: incorrect flags\n"); + return -EINVAL; + } + req = aio_get_req(ctx); if (unlikely(!req)) return -EAGAIN;