If we submit an unknown opcode and have fd == -1, io_op_needs_file() will return true as we default to needing a file. Then when we go and assign the file, we find the 'fd' invalid and return -EBADF. We really should be returning -EINVAL for that case, as we normally do for unsupported opcodes. Change io_op_needs_file() to have the following return values: 0 - does not need a file 1 - does need a file < 0 - error value and use this to pass back the right value for this invalid case.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -58,23 +58,28 @@ struct io_uring_sqe { · 57 unmodified lines | ||
| 58 | 58 | #define IORING_SETUP_SQ_AFF (1U << 2) /* sq_thread_cpu is valid */ |
| 59 | 59 | #define IORING_SETUP_CQSIZE (1U << 3) /* app defines CQ size */ |
| 60 | 60 | |
| 61 | −#define IORING_OP_NOP 0 | |
| 62 | −#define IORING_OP_READV 1 | |
| 63 | −#define IORING_OP_WRITEV 2 | |
| 64 | −#define IORING_OP_FSYNC 3 | |
| 65 | −#define IORING_OP_READ_FIXED 4 | |
| 66 | −#define IORING_OP_WRITE_FIXED 5 | |
| 67 | −#define IORING_OP_POLL_ADD 6 | |
| 68 | −#define IORING_OP_POLL_REMOVE 7 | |
| 69 | −#define IORING_OP_SYNC_FILE_RANGE 8 | |
| 70 | −#define IORING_OP_SENDMSG 9 | |
| 71 | −#define IORING_OP_RECVMSG 10 | |
| 72 | −#define IORING_OP_TIMEOUT 11 | |
| 73 | −#define IORING_OP_TIMEOUT_REMOVE 12 | |
| 74 | −#define IORING_OP_ACCEPT 13 | |
| 75 | −#define IORING_OP_ASYNC_CANCEL 14 | |
| 76 | −#define IORING_OP_LINK_TIMEOUT 15 | |
| 77 | −#define IORING_OP_CONNECT 16 | |
| 61 | +enum { | |
| 62 | + IORING_OP_NOP, | |
| 63 | + IORING_OP_READV, | |
| 64 | + IORING_OP_WRITEV, | |
| 65 | + IORING_OP_FSYNC, | |
| 66 | + IORING_OP_READ_FIXED, | |
| 67 | + IORING_OP_WRITE_FIXED, | |
| 68 | + IORING_OP_POLL_ADD, | |
| 69 | + IORING_OP_POLL_REMOVE, | |
| 70 | + IORING_OP_SYNC_FILE_RANGE, | |
| 71 | + IORING_OP_SENDMSG, | |
| 72 | + IORING_OP_RECVMSG, | |
| 73 | + IORING_OP_TIMEOUT, | |
| 74 | + IORING_OP_TIMEOUT_REMOVE, | |
| 75 | + IORING_OP_ACCEPT, | |
| 76 | + IORING_OP_ASYNC_CANCEL, | |
| 77 | + IORING_OP_LINK_TIMEOUT, | |
| 78 | + IORING_OP_CONNECT, | |
| 79 | + | |
| 80 | + /* this goes last, obviously */ | |
| 81 | + IORING_OP_LAST, | |
| 82 | +}; | |
| 78 | 83 | |
| 79 | 84 | /* |
| 80 | 85 | * sqe->fsync_flags |