diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2024-12-08 21:43:22 +0000 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-12-23 08:20:41 -0700 |
| commit | 29b95ac917927ce9f95bf38797e16333ecb489b1 (patch) | |
| tree | 041c2edab0f9dd7c931a89fc778912858209a0d0 | |
| parent | de3b9e2e48190be28473ea84c384bc64931facf7 (diff) | |
io_uring: prevent reg-wait speculations
With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
for the waiting loop the user can specify an offset into a pre-mapped
region of memory, in which case the
[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
argument.
As we address a kernel array using a user given index, it'd be a subject
to speculation type of exploits. Use array_index_nospec() to prevent
that. Make sure to pass not the full region size but truncate by the
maximum offset allowed considering the structure size.
Fixes: d617b3147d54c ("io_uring: restore back registered wait arguments")
Fixes: aa00f67adc2c0 ("io_uring: add support for fixed wait regions")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1e3d9da7c43d619de7bcf41d1cd277ab2688c443.1733694126.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 2e6891aadecc..66a93170ad68 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -3211,6 +3211,7 @@ static struct io_uring_reg_wait *io_get_ext_arg_reg(struct io_ring_ctx *ctx, end > ctx->cq_wait_size)) return ERR_PTR(-EFAULT); + offset = array_index_nospec(offset, ctx->cq_wait_size - size); return ctx->cq_wait_arg + offset; } |