If we submit an unknown opcode and have fd == -1, io_op_needs_file() will return true as we default to needing a file. Then when we go and assign the file, we find the 'fd' invalid and return -EBADF. We really should be returning -EINVAL for that case, as we normally do for unsupported opcodes. Change io_op_needs_file() to have the following return values: 0 - does not need a file 1 - does need a file < 0 - error value and use this to pass back the right value for this invalid case.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -58,23 +58,28 @@ struct io_uring_sqe { · 57 unmodified lines | |||
| 58 | #define IORING_SETUP_SQ_AFF (1U << 2) /* sq_thread_cpu is valid */ | 58 | #define IORING_SETUP_SQ_AFF (1U << 2) /* sq_thread_cpu is valid */ |
| 59 | #define IORING_SETUP_CQSIZE (1U << 3) /* app defines CQ size */ | 59 | #define IORING_SETUP_CQSIZE (1U << 3) /* app defines CQ size */ |
| 60 | 60 | ||
| 61 | #define IORING_OP_NOP 0 | 61 | enum { |
| 62 | #define IORING_OP_READV 1 | 62 | IORING_OP_NOP, |
| 63 | #define IORING_OP_WRITEV 2 | 63 | IORING_OP_READV, |
| 64 | #define IORING_OP_FSYNC 3 | 64 | IORING_OP_WRITEV, |
| 65 | #define IORING_OP_READ_FIXED 4 | 65 | IORING_OP_FSYNC, |
| 66 | #define IORING_OP_WRITE_FIXED 5 | 66 | IORING_OP_READ_FIXED, |
| 67 | #define IORING_OP_POLL_ADD 6 | 67 | IORING_OP_WRITE_FIXED, |
| 68 | #define IORING_OP_POLL_REMOVE 7 | 68 | IORING_OP_POLL_ADD, |
| 69 | #define IORING_OP_SYNC_FILE_RANGE 8 | 69 | IORING_OP_POLL_REMOVE, |
| 70 | #define IORING_OP_SENDMSG 9 | 70 | IORING_OP_SYNC_FILE_RANGE, |
| 71 | #define IORING_OP_RECVMSG 10 | 71 | IORING_OP_SENDMSG, |
| 72 | #define IORING_OP_TIMEOUT 11 | 72 | IORING_OP_RECVMSG, |
| 73 | #define IORING_OP_TIMEOUT_REMOVE 12 | 73 | IORING_OP_TIMEOUT, |
| 74 | #define IORING_OP_ACCEPT 13 | 74 | IORING_OP_TIMEOUT_REMOVE, |
| 75 | #define IORING_OP_ASYNC_CANCEL 14 | 75 | IORING_OP_ACCEPT, |
| 76 | #define IORING_OP_LINK_TIMEOUT 15 | 76 | IORING_OP_ASYNC_CANCEL, |
| 77 | #define IORING_OP_CONNECT 16 | 77 | IORING_OP_LINK_TIMEOUT, |
| 78 | IORING_OP_CONNECT, | ||
| 79 | |||
| 80 | /* this goes last, obviously */ | ||
| 81 | IORING_OP_LAST, | ||
| 82 | }; | ||
| 78 | 83 | ||
| 79 | /* | 84 | /* |
| 80 | * sqe->fsync_flags | 85 | * sqe->fsync_flags |