On Sun, 08 Dec 2024 21:43:22 +0000, Pavel Begunkov wrote:
> With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
> for the waiting loop the user can specify an offset into a pre-mapped
> region of memory, in which case the
> [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
> argument.
>
> As we address a kernel array using a user given index, it'd be a subject
> to speculation type of exploits. Use array_index_nospec() to prevent
> that. Make sure to pass not the full region size but truncate by the
> maximum offset allowed considering the structure size.
>
> [...]
Applied, thanks!
[1/1] io_uring: prevent reg-wait speculations
commit: f137f14b7ccb78d274430d11b4526617d90739a1
Best regards,
--
Jens Axboe
