[PATCH v2 1/1] io_uring: prevent reg-wait speculations

[PATCH v2 1/1] io_uring: prevent reg-wait speculations

[Pavel Begunkov]

With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
for the waiting loop the user can specify an offset into a pre-mapped
region of memory, in which case the
[offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
argument.

As we address a kernel array using a user given index, it'd be a subject
to speculation type of exploits. Use array_index_nospec() to prevent
that. Make sure to pass not the full region size but truncate by the
maximum offset allowed considering the structure size.

Fixes: d617b3147d54c ("io_uring: restore back registered wait arguments")
Fixes: aa00f67adc2c0 ("io_uring: add support for fixed wait regions")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---

v2: use array_index_nospec()

 io_uring/io_uring.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index a32c5c19a79d..e209695c28e4 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3213,6 +3213,7 @@ static struct io_uring_reg_wait *io_get_ext_arg_reg(struct io_ring_ctx *ctx,
 		     end > ctx->cq_wait_size))
 		return ERR_PTR(-EFAULT);
 
+	offset = array_index_nospec(offset, ctx->cq_wait_size - size);
 	return ctx->cq_wait_arg + offset;
 }
 
-- 
2.47.1

Re: [PATCH v2 1/1] io_uring: prevent reg-wait speculations

[Jens Axboe]

On Sun, 08 Dec 2024 21:43:22 +0000, Pavel Begunkov wrote:
> With *ENTER_EXT_ARG_REG instead of passing a user pointer with arguments
> for the waiting loop the user can specify an offset into a pre-mapped
> region of memory, in which case the
> [offset, offset + sizeof(io_uring_reg_wait)) will be intepreted as the
> argument.
> 
> As we address a kernel array using a user given index, it'd be a subject
> to speculation type of exploits. Use array_index_nospec() to prevent
> that. Make sure to pass not the full region size but truncate by the
> maximum offset allowed considering the structure size.
> 
> [...]

Applied, thanks!

[1/1] io_uring: prevent reg-wait speculations
      commit: f137f14b7ccb78d274430d11b4526617d90739a1

Best regards,
-- 
Jens Axboe