@@ -1036,7 +1036,7 @@ static void io_put_task(struct task_struct *task, int nr);
1036
1036
static struct io_kiocb * io_prep_linked_timeout (struct io_kiocb * req );
1037
1037
static void io_queue_linked_timeout (struct io_kiocb * req );
1038
1038
static int __io_register_rsrc_update (struct io_ring_ctx * ctx , unsigned type ,
1039
- struct io_uring_rsrc_update * up ,
1039
+ struct io_uring_rsrc_update2 * up ,
1040
1040
unsigned nr_args );
1041
1041
static void io_clean_op (struct io_kiocb * req );
1042
1042
static struct file * io_file_get (struct io_submit_state * state ,
@@ -5814,14 +5814,16 @@ static int io_rsrc_update_prep(struct io_kiocb *req,
5814
5814
static int io_files_update (struct io_kiocb * req , unsigned int issue_flags )
5815
5815
{
5816
5816
struct io_ring_ctx * ctx = req -> ctx ;
5817
- struct io_uring_rsrc_update up ;
5817
+ struct io_uring_rsrc_update2 up ;
5818
5818
int ret ;
5819
5819
5820
5820
if (issue_flags & IO_URING_F_NONBLOCK )
5821
5821
return - EAGAIN ;
5822
5822
5823
5823
up .offset = req -> rsrc_update .offset ;
5824
5824
up .data = req -> rsrc_update .arg ;
5825
+ up .nr = 0 ;
5826
+ up .tags = 0 ;
5825
5827
5826
5828
mutex_lock (& ctx -> uring_lock );
5827
5829
ret = __io_register_rsrc_update (ctx , IORING_RSRC_FILE ,
@@ -7732,9 +7734,10 @@ static int io_queue_rsrc_removal(struct io_rsrc_data *data, unsigned idx,
7732
7734
}
7733
7735
7734
7736
static int __io_sqe_files_update (struct io_ring_ctx * ctx ,
7735
- struct io_uring_rsrc_update * up ,
7737
+ struct io_uring_rsrc_update2 * up ,
7736
7738
unsigned nr_args )
7737
7739
{
7740
+ u64 __user * tags = u64_to_user_ptr (up -> tags );
7738
7741
__s32 __user * fds = u64_to_user_ptr (up -> data );
7739
7742
struct io_rsrc_data * data = ctx -> file_data ;
7740
7743
struct io_fixed_file * file_slot ;
@@ -7749,10 +7752,17 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
7749
7752
return - EINVAL ;
7750
7753
7751
7754
for (done = 0 ; done < nr_args ; done ++ ) {
7752
- if (copy_from_user (& fd , & fds [done ], sizeof (fd ))) {
7755
+ u64 tag = 0 ;
7756
+
7757
+ if ((tags && copy_from_user (& tag , & tags [done ], sizeof (tag ))) ||
7758
+ copy_from_user (& fd , & fds [done ], sizeof (fd ))) {
7753
7759
err = - EFAULT ;
7754
7760
break ;
7755
7761
}
7762
+ if ((fd == IORING_REGISTER_FILES_SKIP || fd == -1 ) && tag ) {
7763
+ err = - EINVAL ;
7764
+ break ;
7765
+ }
7756
7766
if (fd == IORING_REGISTER_FILES_SKIP )
7757
7767
continue ;
7758
7768
@@ -7787,6 +7797,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
7787
7797
err = - EBADF ;
7788
7798
break ;
7789
7799
}
7800
+ data -> tags [up -> offset + done ] = tag ;
7790
7801
io_fixed_file_set (file_slot , file );
7791
7802
err = io_sqe_file_register (ctx , file , i );
7792
7803
if (err ) {
@@ -9718,12 +9729,14 @@ static int io_register_enable_rings(struct io_ring_ctx *ctx)
9718
9729
}
9719
9730
9720
9731
static int __io_register_rsrc_update (struct io_ring_ctx * ctx , unsigned type ,
9721
- struct io_uring_rsrc_update * up ,
9732
+ struct io_uring_rsrc_update2 * up ,
9722
9733
unsigned nr_args )
9723
9734
{
9724
9735
__u32 tmp ;
9725
9736
int err ;
9726
9737
9738
+ if (up -> resv )
9739
+ return - EINVAL ;
9727
9740
if (check_add_overflow (up -> offset , nr_args , & tmp ))
9728
9741
return - EOVERFLOW ;
9729
9742
err = io_rsrc_node_switch_start (ctx );
@@ -9737,18 +9750,31 @@ static int __io_register_rsrc_update(struct io_ring_ctx *ctx, unsigned type,
9737
9750
return - EINVAL ;
9738
9751
}
9739
9752
9740
- static int io_register_rsrc_update (struct io_ring_ctx * ctx , unsigned type ,
9741
- void __user * arg , unsigned nr_args )
9753
+ static int io_register_files_update (struct io_ring_ctx * ctx , void __user * arg ,
9754
+ unsigned nr_args )
9742
9755
{
9743
- struct io_uring_rsrc_update up ;
9756
+ struct io_uring_rsrc_update2 up ;
9744
9757
9745
9758
if (!nr_args )
9746
9759
return - EINVAL ;
9760
+ memset (& up , 0 , sizeof (up ));
9761
+ if (copy_from_user (& up , arg , sizeof (struct io_uring_rsrc_update )))
9762
+ return - EFAULT ;
9763
+ return __io_register_rsrc_update (ctx , IORING_RSRC_FILE , & up , nr_args );
9764
+ }
9765
+
9766
+ static int io_register_rsrc_update (struct io_ring_ctx * ctx , void __user * arg ,
9767
+ unsigned size )
9768
+ {
9769
+ struct io_uring_rsrc_update2 up ;
9770
+
9771
+ if (size != sizeof (up ))
9772
+ return - EINVAL ;
9747
9773
if (copy_from_user (& up , arg , sizeof (up )))
9748
9774
return - EFAULT ;
9749
- if (up .resv )
9775
+ if (! up .nr )
9750
9776
return - EINVAL ;
9751
- return __io_register_rsrc_update (ctx , type , & up , nr_args );
9777
+ return __io_register_rsrc_update (ctx , up . type , & up , up . nr );
9752
9778
}
9753
9779
9754
9780
static int io_register_rsrc (struct io_ring_ctx * ctx , void __user * arg ,
@@ -9784,6 +9810,7 @@ static bool io_register_op_must_quiesce(int op)
9784
9810
case IORING_REGISTER_PERSONALITY :
9785
9811
case IORING_UNREGISTER_PERSONALITY :
9786
9812
case IORING_REGISTER_RSRC :
9813
+ case IORING_REGISTER_RSRC_UPDATE :
9787
9814
return false;
9788
9815
default :
9789
9816
return true;
@@ -9861,7 +9888,7 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
9861
9888
ret = io_sqe_files_unregister (ctx );
9862
9889
break ;
9863
9890
case IORING_REGISTER_FILES_UPDATE :
9864
- ret = io_register_rsrc_update (ctx , IORING_RSRC_FILE , arg , nr_args );
9891
+ ret = io_register_files_update (ctx , arg , nr_args );
9865
9892
break ;
9866
9893
case IORING_REGISTER_EVENTFD :
9867
9894
case IORING_REGISTER_EVENTFD_ASYNC :
@@ -9912,6 +9939,9 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
9912
9939
case IORING_REGISTER_RSRC :
9913
9940
ret = io_register_rsrc (ctx , arg , nr_args );
9914
9941
break ;
9942
+ case IORING_REGISTER_RSRC_UPDATE :
9943
+ ret = io_register_rsrc_update (ctx , arg , nr_args );
9944
+ break ;
9915
9945
default :
9916
9946
ret = - EINVAL ;
9917
9947
break ;
0 commit comments