github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

io_uring/rsrc: unify nospec indexing for direct descriptors

Browse Source 
For file updates, the node reset isn't capping the value via
array_index_nospec() like the other paths do. Ensure it's all sane and
have the update path do the proper capping as well.

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2026-04-20 13:14:54 -06:00
parent 8e1f412b5b
commit 53262c91f7
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
io_uring/rsrc.c
View File

@ -238,6 +238,9 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
continue;
i = up->offset + done;
if (i >= ctx->file_table.data.nr)
break;
i = array_index_nospec(i, ctx->file_table.data.nr);
if (io_reset_rsrc_node(ctx, &ctx->file_table.data, i))
io_file_bitmap_clear(&ctx->file_table, i);

9
io_uring/rsrc.h
View File

@ -109,10 +109,15 @@ static inline void io_put_rsrc_node(struct io_ring_ctx *ctx, struct io_rsrc_node
}
static inline bool io_reset_rsrc_node(struct io_ring_ctx *ctx,
struct io_rsrc_data *data, int index)
struct io_rsrc_data *data,
unsigned int index)
{
struct io_rsrc_node *node = data->nodes[index];
struct io_rsrc_node *node;
if (index >= data->nr)
return false;
index = array_index_nospec(index, data->nr);
node = data->nodes[index];
if (!node)
return false;
io_put_rsrc_node(ctx, node);