Re: [PATCH] io_uring/tctx: prevent loop variable modification

[Jens Axboe <axboe@kernel.dk>]

On 2/8/26 11:19 PM, Yang Xiuwei wrote:
> Modifying the loop variable with array_index_nospec() can skip indices
> and cause an infinite loop when end > IO_RINGFD_REG_MAX and all slots
> are occupied.
> 
> Use a separate 'idx' variable instead.
> 
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> 
> diff --git a/io_uring/tctx.c b/io_uring/tctx.c
> index 6d6f44215ec8..fcf79df923a0 100644
> --- a/io_uring/tctx.c
> +++ b/io_uring/tctx.c
> @@ -221,14 +221,15 @@ void io_uring_unreg_ringfd(void)
>  int io_ring_add_registered_file(struct io_uring_task *tctx, struct file *file,
>  				     int start, int end)
>  {
> -	int offset;
> +	int offset, idx;
> +
>  	for (offset = start; offset < end; offset++) {
> -		offset = array_index_nospec(offset, IO_RINGFD_REG_MAX);
> -		if (tctx->registered_rings[offset])
> +		idx = array_index_nospec(offset, IO_RINGFD_REG_MAX);
> +		if (tctx->registered_rings[idx])
>  			continue;
>  
> -		tctx->registered_rings[offset] = file;
> -		return offset;
> +		tctx->registered_rings[idx] = file;
> +		return idx;
>  	}
>  	return -EBUSY;
>  }

I think this is fine as a cleanup as it makes it more clear, but I fail
to see how you can ever have this cause an issue.

-- 
Jens Axboe