Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/io_uring
History
Nicholas Carlini 5170efd9c3 io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check 
__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte
SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second
half of the SQE would be past the end of the sq_sqes array. The current
check tests (++sq_head & sq_mask) == 0, but sq_head is only incremented
when a 128-byte SQE is encountered, not on every iteration. The actual
array index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask
(the last slot) while the wrap check passes.

Fix by checking sq_idx directly. Keep the sq_head increment so the loop
still skips the second half of the 128-byte SQE on the next iteration.

Fixes: 1cba30bf9f ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
Link: https://patch.msgid.link/20260327021823.3138396-1-nicholas@carlini.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-26 20:28:28 -06:00
..
advise.c
advise.h
alloc_cache.c
alloc_cache.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
bpf_filter.c io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration 2026-03-09 14:20:14 -06:00
bpf_filter.h io_uring: allow registration of per-task restrictions 2026-02-06 07:29:19 -07:00
cancel.c for-7.0/io_uring-20260206 2026-02-09 17:22:00 -08:00
cancel.h io_uring/cancel: de-unionize file and user_data in struct io_cancel_data 2026-02-16 14:16:27 -07:00
cmd_net.c io_uring/cmd_net: use READ_ONCE() for ->addr3 read 2026-02-24 11:38:34 -07:00
epoll.c
epoll.h
eventfd.c io_uring/eventfd: use ctx->rings_rcu for flags checking 2026-03-11 14:35:19 -06:00
eventfd.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
fdinfo.c io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check 2026-03-26 20:28:28 -06:00
fdinfo.h
filetable.c io_uring/filetable: clamp alloc_hint to the configured alloc range 2026-02-11 15:20:44 -07:00
filetable.h io_uring: Trim out unused includes 2026-01-05 17:08:20 -07:00
fs.c non-consuming variants of do_{unlinkat,rmdir}() 2026-01-16 12:51:50 -05:00
fs.h
futex.c io_uring/futex: use GFP_KERNEL_ACCOUNT for futex data allocation 2026-01-25 10:07:09 -07:00
futex.h
io-wq.c for-7.0/io_uring-20260206 2026-02-09 17:22:00 -08:00
io-wq.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
io_uring.c io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops 2026-03-11 14:35:19 -06:00
io_uring.h io_uring: add IORING_OP_URING_CMD128 to opcode checks 2026-02-19 07:25:39 -07:00
kbuf.c io_uring/kbuf: propagate BUF_MORE through early buffer commit path 2026-03-19 15:09:48 -06:00
kbuf.h io_uring/kbuf: remove obsolete buf_nr_pages and update comments 2025-11-20 13:23:05 -07:00
Kconfig io_uring: add support for BPF filtering for opcode restrictions 2026-01-27 11:09:57 -07:00
Makefile io_uring: add support for BPF filtering for opcode restrictions 2026-01-27 11:09:57 -07:00
memmap.c for-7.0/io_uring-20260206 2026-02-09 17:22:00 -08:00
memmap.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
mock_file.c io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
msg_ring.c io_uring/msg_ring: drop unnecessary submitter_task checks 2026-01-12 11:21:38 -07:00
msg_ring.h
napi.c
napi.h
net.c io_uring/net: reject SEND_VECTORIZED when unsupported 2026-03-02 09:17:04 -07:00
net.h io_uring/net: allow filtering on IORING_OP_SOCKET data 2026-01-27 11:10:46 -07:00
nop.c io_uring/nop: add support for IORING_SETUP_CQE_MIXED 2025-08-27 11:24:15 -06:00
nop.h
notif.c io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
notif.h
opdef.c io_uring/bpf_filter: move filter size and populate helper into struct 2026-02-16 15:56:25 -07:00
opdef.h io_uring/bpf_filter: move filter size and populate helper into struct 2026-02-16 15:56:25 -07:00
openclose.c io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots 2026-02-11 20:31:21 -07:00
openclose.h io_uring/bpf_filter: allow filtering on contents of struct open_how 2026-01-27 11:10:46 -07:00
poll.c io_uring/poll: fix multishot recv missing EOF on wakeup race 2026-03-17 13:54:08 -06:00
poll.h io_uring: add wrapper type for io_req_tw_func_t arg 2025-11-03 08:31:26 -07:00
query.c io_uring/query: return support for custom rx page size 2026-02-15 14:55:37 -07:00
query.h io_uring/query: drop unused io_handle_query_entry() ctx arg 2025-11-26 09:37:10 -07:00
refs.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
register.c io_uring: ensure ctx->rings is stable for task work flags manipulation 2026-03-11 14:35:16 -06:00
register.h
rsrc.c io_uring/rsrc: improve regbuf iov validation 2026-02-16 08:15:38 -07:00
rsrc.h io_uring/rsrc: replace reg buffer bit field with flags 2026-02-10 05:26:15 -07:00
rw.c io_uring: add IORING_OP_URING_CMD128 to opcode checks 2026-02-19 07:25:39 -07:00
rw.h io_uring: add wrapper type for io_req_tw_func_t arg 2025-11-03 08:31:26 -07:00
slist.h io_uring: Add SPDX id lines to remaining source files 2026-02-04 07:23:45 -07:00
splice.c io_uring: don't include filetable.h in io_uring.h 2025-09-08 13:20:46 -06:00
splice.h
sqpoll.c io_uring: IOPOLL polling improvements 2025-12-28 15:54:45 -07:00
sqpoll.h io_uring/sqpoll: switch away from getrusage() for CPU accounting 2025-10-22 10:51:20 -06:00
statx.c allow incomplete imports of filenames 2026-01-13 15:18:07 -05:00
statx.h
sync.c io_uring/sync: validate passed in offset 2026-01-21 11:50:59 -07:00
sync.h
tctx.c io_uring/tctx: avoid modifying loop variable in io_ring_add_registered_file 2026-02-09 20:12:46 -07:00
tctx.h
timeout.c io_uring/timeout: READ_ONCE sqe->addr 2026-02-25 08:36:05 -07:00
timeout.h
truncate.c
truncate.h
tw.c io_uring: ensure ctx->rings is stable for task work flags manipulation 2026-03-11 14:35:16 -06:00
tw.h io_uring: split out CQ waiting code into wait.c 2026-01-22 09:21:16 -07:00
uring_cmd.c io_uring/uring_cmd: explicitly disallow cancelations for IOPOLL 2026-01-14 22:04:11 -07:00
uring_cmd.h
wait.c io_uring: split out CQ waiting code into wait.c 2026-01-22 09:21:16 -07:00
wait.h io_uring: split out CQ waiting code into wait.c 2026-01-22 09:21:16 -07:00
waitid.c io_uring/waitid: fix KCSAN warning on io_waitid->head 2026-01-19 19:55:30 -07:00
waitid.h
xattr.c filename_...xattr(): don't consume filename reference 2026-01-16 12:52:03 -05:00
xattr.h
zcrx.c io_uring/zcrx: use READ_ONCE with user shared RQEs 2026-03-04 06:30:39 -07:00
zcrx.h io_uring/zcrx: count zcrx users 2025-11-13 11:19:37 -07:00