diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-01-22 17:29:31 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 09:58:10 +0100 |
| commit | 206d8e0242de470f9a0d85c490760ad12b57a079 (patch) | |
| tree | f4ae53092ccfb5d3e8e89af290261c844a190344 /io_uring | |
| parent | 21cfbeae7d7c54a6cdea4b00096150f438f4fbde (diff) | |
| download | linux-206d8e0242de470f9a0d85c490760ad12b57a079.tar.gz linux-206d8e0242de470f9a0d85c490760ad12b57a079.tar.bz2 linux-206d8e0242de470f9a0d85c490760ad12b57a079.zip | |
io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
[ Upstream commit d58d82bd0efd6c8edd452fc2f6c6dd052ec57cb2 ]
io_uring_cmd_sock() does a normal read of cmd->sqe->cmd_op, where it
really should be using a READ_ONCE() as ->sqe may still be pointing to
the original SQE. Since the prep side already does this READ_ONCE() and
stores it locally, use that value rather than re-read it.
Fixes: 8e9fad0e70b7b ("io_uring: Add io_uring command support for sockets")
Link: https://lore.kernel.org/r/20250121-uring-sockcmd-fix-v1-1-add742802a29@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/uring_cmd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index 883510a3e8d0..874f9e2defd5 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -340,7 +340,7 @@ int io_uring_cmd_sock(struct io_uring_cmd *cmd, unsigned int issue_flags) if (!prot || !prot->ioctl) return -EOPNOTSUPP; - switch (cmd->sqe->cmd_op) { + switch (cmd->cmd_op) { case SOCKET_URING_OP_SIOCINQ: ret = prot->ioctl(sk, SIOCINQ, &arg); if (ret) |