This is a note to let you know that I've just added the patch titled io_uring: move io_uring_rsrc_update2 validation to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-move-io_uring_rsrc_update2-validation.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit e76c634b5e87cd1aebaf283326dc336eeab9dea7 Author: Dylan Yudaken <dylany@xxxxxx> Date: Tue Apr 12 09:30:39 2022 -0700 io_uring: move io_uring_rsrc_update2 validation [ Upstream commit 565c5e616e8061b40a2e1d786c418a7ac3503a8d ] Move validation to be more consistently straight after copy_from_user. This is already done in io_register_rsrc_update and so this removes that redundant check. Signed-off-by: Dylan Yudaken <dylany@xxxxxx> Link: https://lore.kernel.org/r/20220412163042.2788062-2-dylany@xxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/fs/io_uring.c b/fs/io_uring.c index e3d1fc954933..7da6fddaef4d 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -10784,8 +10784,6 @@ static int __io_register_rsrc_update(struct io_ring_ctx *ctx, unsigned type, __u32 tmp; int err; - if (up->resv) - return -EINVAL; if (check_add_overflow(up->offset, nr_args, &tmp)) return -EOVERFLOW; err = io_rsrc_node_switch_start(ctx); @@ -10811,6 +10809,8 @@ static int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg, memset(&up, 0, sizeof(up)); if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update))) return -EFAULT; + if (up.resv) + return -EINVAL; return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args); }