io_uring: ensure that io_init_req() passes in the right issue_flags
We can't use 0 here, as io_init_req() is always invoked with the
ctx uring_lock held. Newer kernels have IO_URING_F_UNLOCKED for this,
but previously we used IO_URING_F_NONBLOCK to indicate this as well.
BUG=b/277048957,b/277623506
TEST=presubmit,validation
RELEASE_NOTE=Fixed race condition in io_uring in the Linux kernel.
Fixes: 08681391b84d ("io_uring: add missing lock in io_get_file_fixed")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cos-patch: security-moderate
Change-Id: I7c1c1d1929faf673627904d84da55c5298add77c
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46468
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/46908
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 54c2b25..48707ae 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -7188,7 +7188,8 @@
if (io_op_defs[req->opcode].needs_file) {
req->file = io_file_get(ctx, req, READ_ONCE(sqe->fd),
- (sqe_flags & IOSQE_FIXED_FILE), 0);
+ (sqe_flags & IOSQE_FIXED_FILE),
+ IO_URING_F_NONBLOCK);
if (unlikely(!req->file))
ret = -EBADF;
}
