io_uring: prevent speculating sq_array indexing

isilence · axboe · commit 483242714fcc · 2024-11-06T13:55:38.000-07:00
The SQ index array consists of user provided indexes, which io_uring then uses to index the SQ, and so it's susceptible to speculation. For all other queues io_uring tracks heads and tails in kernel, and they shouldn't need any special care. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/c6c7a25962924a55869e317e4fdb682dfdc6b279.1730687889.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
@@ -2245,6 +2245,7 @@ static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe)
 				   READ_ONCE(ctx->rings->sq_dropped) + 1);
 			return false;
 		}
+		head = array_index_nospec(head, ctx->sq_entries);
 	}
 
 	/*

Original file line number	Diff line number	Diff line change
`@@ -2245,6 +2245,7 @@ static bool io_get_sqe(struct io_ring_ctx ctx, const struct io_uring_sqe *sqe)`
`2245`	`2245`	`READ_ONCE(ctx->rings->sq_dropped) + 1);`
`2246`	`2246`	`return false;`
`2247`	`2247`	`}`
	`2248`	`+ head = array_index_nospec(head, ctx->sq_entries);`
`2248`	`2249`	`}`
`2249`	`2250`
`2250`	`2251`	`/*`