Commit 29b95ac9 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: prevent reg-wait speculations 



With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
for the waiting loop the user can specify an offset into a pre-mapped
region of memory, in which case the
[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
argument.

As we address a kernel array using a user given index, it'd be a subject
to speculation type of exploits. Use array_index_nospec() to prevent
that. Make sure to pass not the full region size but truncate by the
maximum offset allowed considering the structure size.

Fixes: d617b314 ("io_uring: restore back registered wait arguments")
Fixes: aa00f67a ("io_uring: add support for fixed wait regions")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1e3d9da7c43d619de7bcf41d1cd277ab2688c443.1733694126.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent de3b9e2e

io_uring/io_uring.c

+1 −0
Original line number Diff line number Diff line
@@ -3211,6 +3211,7 @@ static struct io_uring_reg_wait *io_get_ext_arg_reg(struct io_ring_ctx *ctx, 
		     end > ctx->cq_wait_size))

		return ERR_PTR(-EFAULT);



	offset = array_index_nospec(offset, ctx->cq_wait_size - size);

	return ctx->cq_wait_arg + offset;

}