From: Yang Xiuwei <yangxiuwei@kylinos.cn>
To: axboe@kernel.dk
Cc: io-uring@vger.kernel.org, Yang Xiuwei <yangxiuwei@kylinos.cn>
Subject: [PATCH] io_uring/tctx: prevent loop variable modification
Date: Mon, 9 Feb 2026 14:19:19 +0800 [thread overview]
Message-ID: <20260209061919.425074-1-yangxiuwei@kylinos.cn> (raw)
Modifying the loop variable with array_index_nospec() can skip indices
and cause an infinite loop when end > IO_RINGFD_REG_MAX and all slots
are occupied.
Use a separate 'idx' variable instead.
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index 6d6f44215ec8..fcf79df923a0 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -221,14 +221,15 @@ void io_uring_unreg_ringfd(void)
int io_ring_add_registered_file(struct io_uring_task *tctx, struct file *file,
int start, int end)
{
- int offset;
+ int offset, idx;
+
for (offset = start; offset < end; offset++) {
- offset = array_index_nospec(offset, IO_RINGFD_REG_MAX);
- if (tctx->registered_rings[offset])
+ idx = array_index_nospec(offset, IO_RINGFD_REG_MAX);
+ if (tctx->registered_rings[idx])
continue;
- tctx->registered_rings[offset] = file;
- return offset;
+ tctx->registered_rings[idx] = file;
+ return idx;
}
return -EBUSY;
}
--
2.25.1
next reply other threads:[~2026-02-09 6:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-09 6:19 Yang Xiuwei [this message]
2026-02-09 11:42 ` [PATCH] io_uring/tctx: prevent loop variable modification Jens Axboe
2026-02-10 1:31 ` Yang Xiuwei
2026-02-10 2:02 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260209061919.425074-1-yangxiuwei@kylinos.cn \
--to=yangxiuwei@kylinos.cn \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox