Commit 9c3e4274 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Long Li
Browse files

io_uring: prevent opcode speculation 

mainline inclusion
from mainline-v6.10-rc2
commit 1e988c3fe1264708f4f92109203ac5b1d65de50b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU
CVE: CVE-2025-21863

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1e988c3fe1264708f4f92109203ac5b1d65de50b



--------------------------------

sqe->opcode is used for different tables, make sure we santitise it
against speculations.

Cc: stable@vger.kernel.org
Fixes: d3656344 ("io_uring: add lookup table for various opcode needs")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Reviewed-by: default avatarLi Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.1739568408.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Conflicts:
	io_uring/io_uring.c
[Context conflict]
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 762816c3

io_uring/io_uring.c

+2 −0
Original line number Diff line number Diff line
@@ -7196,6 +7196,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 
	if (!io_check_restriction(ctx, req, sqe_flags))

		return -EACCES;



	req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST);



	if ((sqe_flags & IOSQE_BUFFER_SELECT) &&

	    !io_op_defs[req->opcode].buffer_select)

		return -EOPNOTSUPP;