1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
/*
* Based on description from Al Viro - this demonstrates a leak of the
* io_uring instance, by sending the io_uring fd over a UNIX socket.
*
* See:
*
* https://lore.kernel.org/linux-block/20190129192702.3605-1-axboe@kernel.dk/T/#m6c87fc64e4d063786af6ec6fadce3ac1e95d3184
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
#include <signal.h>
#include <inttypes.h>
#include <sys/types.h>
#include <sys/syscall.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <linux/fs.h>
#include "liburing.h"
static int __io_uring_register_files(int ring_fd, int fd1, int fd2)
{
__s32 fds[2] = { fd1, fd2 };
return io_uring_register(ring_fd, IORING_REGISTER_FILES, fds, 2);
}
static int get_ring_fd(void)
{
struct io_uring_params p;
int fd;
memset(&p, 0, sizeof(p));
fd = io_uring_setup(2, &p);
if (fd < 0) {
perror("io_uring_setup");
return -1;
}
return fd;
}
static void send_fd(int socket, int fd)
{
char buf[CMSG_SPACE(sizeof(fd))];
struct cmsghdr *cmsg;
struct msghdr msg;
memset(buf, 0, sizeof(buf));
memset(&msg, 0, sizeof(msg));
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
cmsg = CMSG_FIRSTHDR(&msg);
cmsg->cmsg_level = SOL_SOCKET;
cmsg->cmsg_type = SCM_RIGHTS;
cmsg->cmsg_len = CMSG_LEN(sizeof(fd));
memmove(CMSG_DATA(cmsg), &fd, sizeof(fd));
msg.msg_controllen = CMSG_SPACE(sizeof(fd));
if (sendmsg(socket, &msg, 0) < 0)
perror("sendmsg");
}
int main(int argc, char *argv[])
{
int sp[2], pid, ring_fd, ret;
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sp) != 0) {
perror("Failed to create Unix-domain socket pair\n");
return 1;
}
ring_fd = get_ring_fd();
if (ring_fd < 0)
return 1;
ret = __io_uring_register_files(ring_fd, sp[0], sp[1]);
if (ret < 0) {
perror("register files");
return 1;
}
pid = fork();
if (pid)
send_fd(sp[0], ring_fd);
close(ring_fd);
close(sp[0]);
close(sp[1]);
return 0;
}
|
