Commit a82353e4 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Long Li
Browse files

io_uring: prevent opcode speculation 

mainline inclusion
from mainline-v6.10-rc2
commit 1e988c3fe1264708f4f92109203ac5b1d65de50b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU
CVE: CVE-2025-21863

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1e988c3fe1264708f4f92109203ac5b1d65de50b



--------------------------------

sqe->opcode is used for different tables, make sure we santitise it
against speculations.

Cc: stable@vger.kernel.org
Fixes: d3656344 ("io_uring: add lookup table for various opcode needs")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Reviewed-by: default avatarLi Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.1739568408.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 1579902a

io_uring/io_uring.c

+2 −0
Original line number Diff line number Diff line
@@ -2173,6 +2173,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 
		req->opcode = 0;

		return io_init_fail_req(req, -EINVAL);

	}

	opcode = array_index_nospec(opcode, IORING_OP_LAST);



	def = &io_issue_defs[opcode];

	if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) {

		/* enforce forwards compatibility on users */