| Message ID | 7eddbf31c8ca0a3947f8ed98271acc2b4349c016.1739568408.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] io_uring: prevent opcode speculation | expand |
Hi, > -----Original Message----- > From: Pavel Begunkov <asml.silence@gmail.com> > Sent: Saturday, February 15, 2025 6:48 AM > To: io-uring@vger.kernel.org > Cc: asml.silence@gmail.com > Subject: [PATCH 1/1] io_uring: prevent opcode speculation > > sqe->opcode is used for different tables, make sure we santitise it > against speculations. > > Cc: stable@vger.kernel.org > Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") > Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> > --- > io_uring/io_uring.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index > 263e504be4a8..29a42365a481 100644 > --- a/io_uring/io_uring.c > +++ b/io_uring/io_uring.c > @@ -2045,6 +2045,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct > io_kiocb *req, > req->opcode = 0; > return io_init_fail_req(req, -EINVAL); > } > + opcode = array_index_nospec(opcode, IORING_OP_LAST); > + > def = &io_issue_defs[opcode]; > if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { > /* enforce forwards compatibility on users */ > -- > 2.48.1 > Reviewed-by: Li Zetao <lizetao1@huawei.com> --- Li Zetao
On Fri, 14 Feb 2025 22:48:15 +0000, Pavel Begunkov wrote: > sqe->opcode is used for different tables, make sure we santitise it > against speculations. > > Applied, thanks! [1/1] io_uring: prevent opcode speculation commit: 1e988c3fe1264708f4f92109203ac5b1d65de50b Best regards,
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 263e504be4a8..29a42365a481 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2045,6 +2045,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, req->opcode = 0; return io_init_fail_req(req, -EINVAL); } + opcode = array_index_nospec(opcode, IORING_OP_LAST); + def = &io_issue_defs[opcode]; if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { /* enforce forwards compatibility on users */
sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable@vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)