diff options
| author | Michael Bommarito <michael.bommarito@gmail.com> | 2026-05-17 17:30:10 -0400 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-05-18 08:59:12 -0600 |
| commit | cf18e36455603d65d4745de83e2d1743c54ada47 (patch) | |
| tree | 1b4c3c70d772e60402367d0a36c5d9270a457d3b /include/linux/debug_locks.h | |
| parent | 93d93f5f8da791e98159795c6ef683f45bd95d13 (diff) | |
io_uring: propagate array_index_nospec opcode into req->opcode
Commit 1e988c3fe126 ("io_uring: prevent opcode speculation") added
array_index_nospec() to io_init_req(), but applied it only to a local
opcode variable. req->opcode is initialized from sqe->opcode before the
bounds check and remains the raw value.
Keep req->opcode as the canonical opcode in io_init_req(): reject
out-of-range values architecturally, then write the array_index_nospec()
result back to req->opcode before any table lookup. This keeps downstream
users of req->opcode from observing the raw user byte on a mispredicted
path.
No functional change: array_index_nospec() is a no-op for opcodes in
[0, IORING_OP_LAST), and out-of-range opcodes are still rejected at the
bounds check above the assignment.
Fixes: 1e988c3fe126 ("io_uring: prevent opcode speculation")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260517213010.696135-1-michael.bommarito@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'include/linux/debug_locks.h')
0 files changed, 0 insertions, 0 deletions