Pavel BegunkovandGreg Kroah-Hartman d261ead565 io_uring: prevent opcode speculation ...

[ Upstream commit 1e988c3fe1 ]

sqe->opcode is used for different tables, make sure we santitise it
against speculations.

Cc: stable@vger.kernel.org
Fixes: d3656344fe ("io_uring: add lookup table for various opcode needs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Li Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.1739568408.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Robert Garcia <rob_garcia@163.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:39:33 +02:00

..

advise.c

…

advise.h

…

alloc_cache.h

…

cancel.c

io_uring/cancel: support opcode based lookup and cancelation

2026-03-04 07:20:02 -05:00

cancel.h

io_uring/cancel: de-unionize file and user_data in struct io_cancel_data

2026-03-04 07:20:02 -05:00

epoll.c

…

epoll.h

…

fdinfo.c

io_uring/fdinfo: annotate racy sq/cq head/tail reads

2025-06-04 14:40:18 +02:00

fdinfo.h

…

filetable.c

io_uring/filetable: clamp alloc_hint to the configured alloc range

2026-03-04 07:20:54 -05:00

filetable.h

…

fs.c

…

fs.h

…

io_uring.c

io_uring: prevent opcode speculation

2026-06-01 17:39:33 +02:00

io_uring.h

io_uring: include dying ring in task_work "should cancel" state

2025-09-25 10:58:53 +02:00

io-wq.c

io-wq: check that the predecessor is hashed in io_wq_remove_pending()

2026-06-01 17:39:33 +02:00

io-wq.h

…

kbuf.c

io_uring/kbuf: check if target buffer list is still legacy on recycle

2026-03-25 11:03:12 +01:00

kbuf.h

…

Makefile

…

msg_ring.c

…

msg_ring.h

…

net.c

io_uring/poll: fix POLLERR handling

2025-07-24 08:51:48 +02:00

net.h

…

nop.c

…

nop.h

…

notif.c

…

notif.h

…

opdef.c

…

opdef.h

…

openclose.c

io_uring: fix filename leak in __io_openat_prep()

2026-01-11 15:18:56 +01:00

openclose.h

…

poll.c

io_uring/poll: fix multishot recv missing EOF on wakeup race

2026-06-01 17:38:50 +02:00

poll.h

…

refs.h

…

rsrc.c

…

rsrc.h

…

rw.c

io_uring/rw: commit provided buffer state on async

2025-02-21 13:49:53 +01:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: fix sqpoll error handling races

2025-01-02 10:30:54 +01:00

sqpoll.h

…

statx.c

…

statx.h

…

sync.c

io_uring/sync: validate passed in offset

2026-03-04 07:19:24 -05:00

sync.h

…

tctx.c

io_uring/tctx: work around xa_store() allocation error issue

2024-12-14 19:54:49 +01:00

tctx.h

…

timeout.c

io_uring/timeout: check unused sqe fields

2026-06-01 17:38:47 +02:00

timeout.h

…

uring_cmd.c

…

uring_cmd.h

…

xattr.c

…

xattr.h

…