Commit 531bb98a authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring/zcrx: use READ_ONCE with user shared RQEs 



Refill queue entries are shared with the user space, use READ_ONCE when
reading them.

Fixes: 34a3e608 ("io_uring/zcrx: implement zerocopy receive pp memory provider");
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9e7dc228

io_uring/zcrx.c

+3 −2
Original line number Diff line number Diff line
@@ -927,11 +927,12 @@ static inline bool io_parse_rqe(struct io_uring_zcrx_rqe *rqe, 
				struct io_zcrx_ifq *ifq,

				struct net_iov **ret_niov)

{

	__u64 off = READ_ONCE(rqe->off);

	unsigned niov_idx, area_idx;

	struct io_zcrx_area *area;



	area_idx = rqe->off >> IORING_ZCRX_AREA_SHIFT;

	niov_idx = (rqe->off & ~IORING_ZCRX_AREA_MASK) >> ifq->niov_shift;

	area_idx = off >> IORING_ZCRX_AREA_SHIFT;

	niov_idx = (off & ~IORING_ZCRX_AREA_MASK) >> ifq->niov_shift;



	if (unlikely(rqe->__pad || area_idx))

		return false;