Commit 8911798d authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring/register: use stable SQ/CQ ring data during resize 



Normally the kernel would not expect an application to modify any of
the data shared with the kernel during a resize operation, but of
course the kernel cannot always assume good intent on behalf of the
application.

As part of resizing the rings, existing SQEs and CQEs are copied over
to the new storage. Resizing uses the masks in the newly allocated
shared storage to index the arrays, however it's possible that malicious
userspace could modify these after they have been sanity checked.

Use the validated and locally stored CQ and SQ ring sizing for masking
to ensure the values are both stable and valid.

Fixes: 79cfe9e5 ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS")
Reported-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent c1c03ee7

io_uring/register.c

+2 −2
Original line number Diff line number Diff line
@@ -514,7 +514,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg) 
		goto overflow;

	for (i = o.rings->sq.head; i < tail; i++) {

		unsigned src_head = i & (ctx->sq_entries - 1);

		unsigned dst_head = i & n.rings->sq_ring_mask;

		unsigned dst_head = i & (p.sq_entries - 1);



		n.sq_sqes[dst_head] = o.sq_sqes[src_head];

	}
@@ -533,7 +533,7 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg) 
	}

	for (i = o.rings->cq.head; i < tail; i++) {

		unsigned src_head = i & (ctx->cq_entries - 1);

		unsigned dst_head = i & n.rings->cq_ring_mask;

		unsigned dst_head = i & (p.cq_entries - 1);



		n.rings->cqes[dst_head] = o.rings->cqes[src_head];

	}