Patch "io_uring: prevent reg-wait speculations" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring: prevent reg-wait speculations

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-prevent-reg-wait-speculations.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bdef6de246227ac8e5f27bec7dd4d309fb0ebff5
Author: Pavel Begunkov <asml.silence@xxxxxxxxx>
Date:   Sun Dec 8 21:43:22 2024 +0000

    io_uring: prevent reg-wait speculations
    
    [ Upstream commit 29b95ac917927ce9f95bf38797e16333ecb489b1 ]
    
    With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
    for the waiting loop the user can specify an offset into a pre-mapped
    region of memory, in which case the
    [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
    argument.
    
    As we address a kernel array using a user given index, it'd be a subject
    to speculation type of exploits. Use array_index_nospec() to prevent
    that. Make sure to pass not the full region size but truncate by the
    maximum offset allowed considering the structure size.
    
    Fixes: d617b3147d54c ("io_uring: restore back registered wait arguments")
    Fixes: aa00f67adc2c0 ("io_uring: add support for fixed wait regions")
    Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
    Link: https://lore.kernel.org/r/1e3d9da7c43d619de7bcf41d1cd277ab2688c443.1733694126.git.asml.silence@xxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 4758f1ba902b9..d062c5c69211b 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3233,6 +3233,7 @@ static struct io_uring_reg_wait *io_get_ext_arg_reg(struct io_ring_ctx *ctx,
 		     end > ctx->cq_wait_size))
 		return ERR_PTR(-EFAULT);
 
+	offset = array_index_nospec(offset, ctx->cq_wait_size - size);
 	return ctx->cq_wait_arg + offset;
 }