[PATCH RFC 5/5] disable fixed file for io_uring getdents for now

From: Hao Xu <hao.xu@linux.dev>
To: io-uring@vger.kernel.org, Jens Axboe <axboe@kernel.dk>
Cc: Dominique Martinet <asmadeus@codewreck.org>,
	Pavel Begunkov <asml.silence@gmail.com>,
	Christian Brauner <brauner@kernel.org>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	Stefan Roesch <shr@fb.com>, Clay Harris <bugs@claycon.org>,
	Dave Chinner <david@fromorbit.com>,
	linux-fsdevel@vger.kernel.org, Wanpeng Li <wanpengli@tencent.com>
Subject: [PATCH RFC 5/5] disable fixed file for io_uring getdents for now
Date: Tue, 18 Jul 2023 21:21:12 +0800	[thread overview]
Message-ID: <20230718132112.461218-6-hao.xu@linux.dev> (raw)
In-Reply-To: <20230718132112.461218-1-hao.xu@linux.dev>

From: Hao Xu <howeyxu@tencent.com>

Fixed file for io_uring getdents can trigger race problem. Users can
register a file to be fixed file in io_uring and then remove other
reference so that there are only fixed file reference of that file.
And then they can issue concurrent async getdents requests or both
async and sync getdents requests without holding the f_pos_lock
since there is a f_count == 1 optimization.

Signed-off-by: Hao Xu <howeyxu@tencent.com>
---
 io_uring/fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/fs.c b/io_uring/fs.c
index 480f25677fed..dc74676b1499 100644
--- a/io_uring/fs.c
+++ b/io_uring/fs.c
@@ -303,6 +303,8 @@ int io_getdents_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_getdents *gd = io_kiocb_to_cmd(req, struct io_getdents);
 
+	if (unlikely(req->flags & REQ_F_FIXED_FILE))
+		return -EBADF;
 	if (READ_ONCE(sqe->off) != 0)
 		return -EINVAL;
 
-- 
2.25.1

