Commit 47abea04 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring: fix off-by-one in sync cancelation file check 



The passed in index should be validated against the number of registered
files we have, it needs to be smaller than the index value to avoid going
one beyond the end.

Fixes: 78a861b9 ("io_uring: add sync cancelation API through io_uring_register()")
Reported-by: default avatarLuo Likang <luolikang@nsfocus.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent e1d0c6d0

io_uring/cancel.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -218,7 +218,7 @@ static int __io_sync_cancel(struct io_uring_task *tctx, 
	    (cd->flags & IORING_ASYNC_CANCEL_FD_FIXED)) {

	    (cd->flags & IORING_ASYNC_CANCEL_FD_FIXED)) {

		unsigned long file_ptr;

		unsigned long file_ptr;





		if (unlikely(fd > ctx->nr_user_files))

		if (unlikely(fd >= ctx->nr_user_files))

			return -EBADF;

			return -EBADF;

		fd = array_index_nospec(fd, ctx->nr_user_files);

		fd = array_index_nospec(fd, ctx->nr_user_files);

		file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr;

		file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr;