diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-04-20 22:14:54 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-04-21 21:18:54 +0300 |
| commit | 53262c91f7b81f96495ff24e9d1fa8b1632e69c8 (patch) | |
| tree | 71ec8df00937bd12a0f4e77b79db6d75cfe3be38 | |
| parent | 8e1f412b5bc690cb72b3303a1ae0d42955e5e2b3 (diff) | |
| download | linux-53262c91f7b81f96495ff24e9d1fa8b1632e69c8.tar.xz | |
io_uring/rsrc: unify nospec indexing for direct descriptors
For file updates, the node reset isn't capping the value via
array_index_nospec() like the other paths do. Ensure it's all sane and
have the update path do the proper capping as well.
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/rsrc.c | 3 | ||||
| -rw-r--r-- | io_uring/rsrc.h | 9 |
2 files changed, 10 insertions, 2 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index fd36e0e319a2..c042054c3b5f 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -238,6 +238,9 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, continue; i = up->offset + done; + if (i >= ctx->file_table.data.nr) + break; + i = array_index_nospec(i, ctx->file_table.data.nr); if (io_reset_rsrc_node(ctx, &ctx->file_table.data, i)) io_file_bitmap_clear(&ctx->file_table, i); diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h index cff0f8834c35..44e3386f7c1c 100644 --- a/io_uring/rsrc.h +++ b/io_uring/rsrc.h @@ -109,10 +109,15 @@ static inline void io_put_rsrc_node(struct io_ring_ctx *ctx, struct io_rsrc_node } static inline bool io_reset_rsrc_node(struct io_ring_ctx *ctx, - struct io_rsrc_data *data, int index) + struct io_rsrc_data *data, + unsigned int index) { - struct io_rsrc_node *node = data->nodes[index]; + struct io_rsrc_node *node; + if (index >= data->nr) + return false; + index = array_index_nospec(index, data->nr); + node = data->nodes[index]; if (!node) return false; io_put_rsrc_node(ctx, node); |