Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > Note that io_sendmsg_prep() handles both IORING_OP_SENDMSG and IORING_OP_SEND, > so this pair of functions can hit the same request. And sqe->msg_flags is > not sanitized at all - it comes straight from user buffer. Assuming ____sys_sendmsg() is fixed, I think it should be sufficient to make io_send() and io_send_zc(). io_sendmsg() and io_sendmsg_zc() will go through ____sys_sendmsg(). David
