io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()

[ Upstream commit d58d82bd0e ]

io_uring_cmd_sock() does a normal read of cmd->sqe->cmd_op, where it
really should be using a READ_ONCE() as ->sqe may still be pointing to
the original SQE. Since the prep side already does this READ_ONCE() and
stores it locally, use that value rather than re-read it.

Fixes: 8e9fad0e70 ("io_uring: Add io_uring command support for sockets")
Link: https://lore.kernel.org/r/20250121-uring-sockcmd-fix-v1-1-add742802a29@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jens Axboe
2025-01-22 17:29:31 -07:00
committed by Greg Kroah-Hartman
parent 730071ea1e
commit 563ba1701b

View File

@@ -175,7 +175,7 @@ int io_uring_cmd_sock(struct io_uring_cmd *cmd, unsigned int issue_flags)
if (!prot || !prot->ioctl) if (!prot || !prot->ioctl)
return -EOPNOTSUPP; return -EOPNOTSUPP;
switch (cmd->sqe->cmd_op) { switch (cmd->cmd_op) {
case SOCKET_URING_OP_SIOCINQ: case SOCKET_URING_OP_SIOCINQ:
ret = prot->ioctl(sk, SIOCINQ, &arg); ret = prot->ioctl(sk, SIOCINQ, &arg);
if (ret) if (ret)