Re: [PATCH 2/6] io_uring/rsrc: unify nospec indexing for direct descriptors

[Gabriel Krisman Bertazi <krisman@suse.de>]

Jens Axboe <axboe@kernel.dk> writes:

> For file updates, the node reset isn't capping the value via
> array_index_nospec() like the other paths do. Ensure it's all sane and
> have the update path do the proper capping as well.
>
> Signed-off-by: Jens Axboe <axboe@kernel.dk>

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>

> ---
>  io_uring/rsrc.c | 3 +++
>  io_uring/rsrc.h | 9 +++++++--
>  2 files changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index fd36e0e319a2..c042054c3b5f 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -238,6 +238,9 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
>  			continue;
>  
>  		i = up->offset + done;
> +		if (i >= ctx->file_table.data.nr)
> +			break;
> +		i = array_index_nospec(i, ctx->file_table.data.nr);

>  		if (io_reset_rsrc_node(ctx, &ctx->file_table.data, i))
>  			io_file_bitmap_clear(&ctx->file_table, i);
>  
> diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
> index cff0f8834c35..44e3386f7c1c 100644
> --- a/io_uring/rsrc.h
> +++ b/io_uring/rsrc.h
> @@ -109,10 +109,15 @@ static inline void io_put_rsrc_node(struct io_ring_ctx *ctx, struct io_rsrc_node
>  }
>  
>  static inline bool io_reset_rsrc_node(struct io_ring_ctx *ctx,
> -				      struct io_rsrc_data *data, int index)
> +				      struct io_rsrc_data *data,
> +				      unsigned int index)
>  {
> -	struct io_rsrc_node *node = data->nodes[index];
> +	struct io_rsrc_node *node;
>  
> +	if (index >= data->nr)
> +		return false;
> +	index = array_index_nospec(index, data->nr);
> +	node = data->nodes[index];
>  	if (!node)
>  		return false;
>  	io_put_rsrc_node(ctx, node);

-- 
Gabriel Krisman Bertazi