Pavel Begunkov b9826e3b26 io_uring: prevent opcode speculation ...

commit 1e988c3fe1 upstream.

sqe->opcode is used for different tables, make sure we santitise it
against speculations.

Cc: stable@vger.kernel.org
Fixes: d3656344fe ("io_uring: add lookup table for various opcode needs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Li Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.1739568408.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-27 04:10:51 -08:00

..

advise.c

…

advise.h

…

alloc_cache.h

…

cancel.c

…

cancel.h

…

epoll.c

…

epoll.h

…

fdinfo.c

…

fdinfo.h

…

filetable.c

io_uring: drop any code related to SCM_RIGHTS

2024-03-26 18:19:09 -04:00

filetable.h

…

fs.c

…

fs.h

…

io_uring.c

io_uring: prevent opcode speculation

2025-02-27 04:10:51 -08:00

io_uring.h

io_uring/rw: avoid punting to io-wq directly

2024-12-27 13:58:57 +01:00

io-wq.c

io_uring/io-wq: inherit cpuset of cgroup in io worker

2024-10-04 16:29:01 +02:00

io-wq.h

…

kbuf.c

io_uring/kbuf: reallocate buf lists on upgrade

2025-02-21 13:57:27 +01:00

kbuf.h

io_uring/kbuf: hold io_buffer_list reference over mmap

2024-04-10 16:36:03 +02:00

Makefile

…

msg_ring.c

…

msg_ring.h

…

net.c

io_uring/net: don't retry connect operation on EPOLLERR

2025-02-17 09:40:36 +01:00

net.h

…

nop.c

io_uring: fail NOP if non-zero op flags is passed in

2024-06-12 11:11:18 +02:00

nop.h

…

notif.c

…

notif.h

…

opdef.c

…

opdef.h

…

openclose.c

…

openclose.h

…

poll.c

io_uring/net: don't retry connect operation on EPOLLERR

2025-02-17 09:40:36 +01:00

poll.h

…

refs.h

…

rsrc.c

io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed

2024-06-27 13:49:10 +02:00

rsrc.h

io_uring: drop any code related to SCM_RIGHTS

2024-03-26 18:19:09 -04:00

rw.c

io_uring/rw: commit provided buffer state on async

2025-02-17 09:40:37 +01:00

rw.h

…

slist.h

…

splice.c

…

splice.h

…

sqpoll.c

io_uring/sqpoll: fix sqpoll error handling races

2025-01-02 10:32:10 +01:00

sqpoll.h

…

statx.c

…

statx.h

…

sync.c

…

sync.h

…

tctx.c

io_uring/tctx: work around xa_store() allocation error issue

2024-12-14 20:00:17 +01:00

tctx.h

…

timeout.c

io_uring/timeout: fix multishot updates

2025-01-17 13:36:19 +01:00

timeout.h

…

uring_cmd.c

io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()

2025-02-08 09:52:33 +01:00

uring_cmd.h

…

xattr.c

…

xattr.h

…