| Message ID | 1e3d9da7c43d619de7bcf41d1cd277ab2688c443.1733694126.git.asml.silence@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2,1/1] io_uring: prevent reg-wait speculations | expand |
On Sun, 08 Dec 2024 21:43:22 +0000, Pavel Begunkov wrote: > With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments > for the waiting loop the user can specify an offset into a pre-mapped > region of memory, in which case the > [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the > argument. > > As we address a kernel array using a user given index, it'd be a subject > to speculation type of exploits. Use array_index_nospec() to prevent > that. Make sure to pass not the full region size but truncate by the > maximum offset allowed considering the structure size. > > [...] Applied, thanks! [1/1] io_uring: prevent reg-wait speculations commit: f137f14b7ccb78d274430d11b4526617d90739a1 Best regards,
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index a32c5c19a79d..e209695c28e4 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -3213,6 +3213,7 @@ static struct io_uring_reg_wait *io_get_ext_arg_reg(struct io_ring_ctx *ctx, end > ctx->cq_wait_size)) return ERR_PTR(-EFAULT); + offset = array_index_nospec(offset, ctx->cq_wait_size - size); return ctx->cq_wait_arg + offset; }
With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments for the waiting loop the user can specify an offset into a pre-mapped region of memory, in which case the [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the argument. As we address a kernel array using a user given index, it'd be a subject to speculation type of exploits. Use array_index_nospec() to prevent that. Make sure to pass not the full region size but truncate by the maximum offset allowed considering the structure size. Fixes: d617b3147d54c ("io_uring: restore back registered wait arguments") Fixes: aa00f67adc2c0 ("io_uring: add support for fixed wait regions") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- v2: use array_index_nospec() io_uring/io_uring.c | 1 + 1 file changed, 1 insertion(+)