diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2024-11-04 12:02:47 +0000 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-11-06 13:55:38 -0700 |
| commit | 483242714fcc853f3f5ef728116f5ec168468bca (patch) | |
| tree | 24a767685e4efe76288d6a6be63e630afee2a12c /io_uring | |
| parent | b6f58a3f4aa8dba424356c7a69388a81f4459300 (diff) | |
io_uring: prevent speculating sq_array indexing
The SQ index array consists of user provided indexes, which io_uring
then uses to index the SQ, and so it's susceptible to speculation. For
all other queues io_uring tracks heads and tails in kernel, and they
shouldn't need any special care.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c6c7a25962924a55869e317e4fdb682dfdc6b279.1730687889.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 7c1ca36b117b..751b9e19da6e 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2245,6 +2245,7 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe) READ_ONCE(ctx->rings->sq_dropped) + 1); return false; } + head = array_index_nospec(head, ctx->sq_entries); } /* |