This is a note to let you know that I've just added the patch titled io_uring/fs: remove sqe->rw_flags checking from LINKAT to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-fs-remove-sqe-rw_flags-checking-from-linkat.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From a52d4f657568d6458e873f74a9602e022afe666f Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Thu, 28 Sep 2023 09:23:27 -0600 Subject: io_uring/fs: remove sqe->rw_flags checking from LINKAT From: Jens Axboe <axboe@xxxxxxxxx> commit a52d4f657568d6458e873f74a9602e022afe666f upstream. This is unionized with the actual link flags, so they can of course be set and they will be evaluated further down. If not we fail any LINKAT that has to set option flags. Fixes: cf30da90bc3a ("io_uring: add support for IORING_OP_LINKAT") Cc: stable@xxxxxxxxxxxxxxx Reported-by: Thomas Leonard <talex5@xxxxxxxxx> Link: https://github.com/axboe/liburing/issues/955 Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/io_uring/fs.c +++ b/io_uring/fs.c @@ -243,7 +243,7 @@ int io_linkat_prep(struct io_kiocb *req, struct io_link *lnk = io_kiocb_to_cmd(req, struct io_link); const char __user *oldf, *newf; - if (sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in) + if (sqe->buf_index || sqe->splice_fd_in) return -EINVAL; if (unlikely(req->flags & REQ_F_FIXED_FILE)) return -EBADF; Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-6.1/io_uring-fs-remove-sqe-rw_flags-checking-from-linkat.patch