This is a note to let you know that I've just added the patch titled io_uring: verify pad field is 0 in io_get_ext_arg to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-verify-pad-field-is-0-in-io_get_ext_arg.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit d25481356561a73a1c207dd5f1e6a63590f24892 Author: Dylan Yudaken <dylany@xxxxxx> Date: Tue Apr 12 09:30:42 2022 -0700 io_uring: verify pad field is 0 in io_get_ext_arg [ Upstream commit d2347b9695dafe5c388a5f9aeb70e27a7a4d29cf ] Ensure that only 0 is passed for pad here. Fixes: c73ebb685fb6 ("io_uring: add timeout support for io_uring_enter()") Signed-off-by: Dylan Yudaken <dylany@xxxxxx> Link: https://lore.kernel.org/r/20220412163042.2788062-5-dylany@xxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/fs/io_uring.c b/fs/io_uring.c index 2838bc6cdbc8..7a652c8eeed2 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -10109,6 +10109,8 @@ static int io_get_ext_arg(unsigned flags, const void __user *argp, size_t *argsz return -EINVAL; if (copy_from_user(&arg, argp, sizeof(arg))) return -EFAULT; + if (arg.pad) + return -EINVAL; *sig = u64_to_user_ptr(arg.sigmask); *argsz = arg.sigmask_sz; *ts = u64_to_user_ptr(arg.ts);