| Message ID | c6c7a25962924a55869e317e4fdb682dfdc6b279.1730687889.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | io_uring: prevent speculating sq_array indexing | expand |
On Mon, 04 Nov 2024 12:02:47 +0000, Pavel Begunkov wrote: > The SQ index array consists of user provided indexes, which io_uring > then uses to index the SQ, and so it's susceptible to speculation. For > all other queues io_uring tracks heads and tails in kernel, and they > shouldn't need any special care. > > Applied, thanks! [1/1] io_uring: prevent speculating sq_array indexing commit: 16a6e0430fcfb38e80477a72079c84c612457e91 Best regards,
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index f34fa1ead2cf..406825d000eb 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2544,6 +2544,7 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe) READ_ONCE(ctx->rings->sq_dropped) + 1); return false; } + head = array_index_nospec(head, ctx->sq_entries); } /*
The SQ index array consists of user provided indexes, which io_uring then uses to index the SQ, and so it's susceptible to speculation. For all other queues io_uring tracks heads and tails in kernel, and they shouldn't need any special care. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/io_uring.c | 1 + 1 file changed, 1 insertion(+)