superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

io_uring/fdinfo: validate opcode before checking if it's an 128b one 

The mixed SQE support assumes that userspace always passes valid data,
that is not the case. Validate the opcode properly before indexing
the io_issue_defs[] array, and pass it through the nospec indexing
as well as it's a user valid indexing a kernel array.

Fixes: 1cba30bf9f ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Reported-by: syzbot+b883b008a0b1067d5833@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
pull/1354/merge
Jens Axboe 2025-10-30 17:02:13 -06:00
parent 101e596e74
commit 8cd5a59e4d
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
io_uring/fdinfo.c
View File

@ -5,6 +5,7 @@
#include <linux/file.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/nospec.h>
#include <linux/io_uring.h>
#include <uapi/linux/io_uring.h>
@ -107,6 +108,9 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
sqe = &ctx->sq_sqes[sq_idx << sq_shift];
opcode = READ_ONCE(sqe->opcode);
if (opcode >= IORING_OP_LAST)
continue;
opcode = array_index_nospec(opcode, IORING_OP_LAST);
if (sq_shift) {
sqe128 = true;
} else if (io_issue_defs[opcode].is_128) {