Re: [PATCH 1/1] io_uring/af_unix: disable sending io_uring over sockets

[Pavel Begunkov <asml.silence@gmail.com>]

On 12/6/23 13:26, Pavel Begunkov wrote:
> File reference cycles have caused lots of problems for io_uring
> in the past, and it still doesn't work exactly right and races with
> unix_stream_read_generic(). The safest fix would be to completely
> disallow sending io_uring files via sockets via SCM_RIGHT, so there
> are no possible cycles invloving registered files and thus rendering
> SCM accounting on the io_uring side unnecessary.

As it involves AF_UNIX I should have CC'ed net maintainers,
I'll be resending it.


> Cc: stable@vger.kernel.org
> Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release")
> Reported-and-suggested-by: Jann Horn <jannh@google.com>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
> 
> Note, it's a minimal patch intended for backporting, all the leftovers
> will be cleaned up separately.
> 
>   io_uring/rsrc.h | 7 -------
>   net/core/scm.c  | 6 ++++++
>   2 files changed, 6 insertions(+), 7 deletions(-)
> 
> diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
> index 8625181fb87a..08ac0d8e07ef 100644
> --- a/io_uring/rsrc.h
> +++ b/io_uring/rsrc.h
> @@ -77,17 +77,10 @@ int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
>   
>   int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file);
>   
> -#if defined(CONFIG_UNIX)
> -static inline bool io_file_need_scm(struct file *filp)
> -{
> -	return !!unix_get_socket(filp);
> -}
> -#else
>   static inline bool io_file_need_scm(struct file *filp)
>   {
>   	return false;
>   }
> -#endif
>   
>   static inline int io_scm_file_account(struct io_ring_ctx *ctx,
>   				      struct file *file)
> diff --git a/net/core/scm.c b/net/core/scm.c
> index 880027ecf516..7dc47c17d863 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -26,6 +26,7 @@
>   #include <linux/nsproxy.h>
>   #include <linux/slab.h>
>   #include <linux/errqueue.h>
> +#include <linux/io_uring.h>
>   
>   #include <linux/uaccess.h>
>   
> @@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
>   
>   		if (fd < 0 || !(file = fget_raw(fd)))
>   			return -EBADF;
> +		/* don't allow io_uring files */
> +		if (io_uring_get_socket(file)) {
> +			fput(file);
> +			return -EINVAL;
> +		}
>   		*fpp++ = file;
>   		fpl->count++;
>   	}

-- 
Pavel Begunkov