author: Pavel Begunkov <asml.silence@gmail.com> 2021-04-15 13:07:40 +0100
committer: Jens Axboe <axboe@kernel.dk> 2021-04-17 19:20:08 -0600
commit: 75c4021aacbd9b5cc13b173d32b49007fd8ccada
parent: 38134ada0ceea3e848fe993263c0ff6207fd46e7
Commit Summary:
Diffstat:
1 file changed, 8 insertions, 12 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bae13811d2f3..e491b815df8c 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9738,6 +9738,14 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
if (percpu_ref_is_dying(&ctx->refs))
return -ENXIO;
+ if (ctx->restricted) {
+ if (opcode >= IORING_REGISTER_LAST)
+ return -EINVAL;
+ opcode = array_index_nospec(opcode, IORING_REGISTER_LAST);
+ if (!test_bit(opcode, ctx->restrictions.register_op))
+ return -EACCES;
+ }
+
if (io_register_op_must_quiesce(opcode)) {
percpu_ref_kill(&ctx->refs);
@@ -9766,18 +9774,6 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
}
}
- if (ctx->restricted) {
- if (opcode >= IORING_REGISTER_LAST) {
- ret = -EINVAL;
- goto out;
- }
-
- if (!test_bit(opcode, ctx->restrictions.register_op)) {
- ret = -EACCES;
- goto out;
- }
- }
-
switch (opcode) {
case IORING_REGISTER_BUFFERS:
ret = io_sqe_buffers_register(ctx, arg, nr_args);
@@ -9851,7 +9847,6 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
break;
}
-out:
if (io_register_op_must_quiesce(opcode)) {
/* bring the ctx back to life */
percpu_ref_reinit(&ctx->refs);