io_uring/fdinfo: validate opcode before checking if it's an 128b one

The mixed SQE support assumes that userspace always passes valid data,
that is not the case. Validate the opcode properly before indexing
the io_issue_defs[] array, and pass it through the nospec indexing
as well as it's a user valid indexing a kernel array.

Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Reported-by: syzbot+b883b008a0b1067d5833@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 248006424cabaca18a78f4d695fbf0007b67618b..ac6e7edc70271144f4ee837cefc0702d502ca1c8 100644 (file)
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -5,6 +5,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/nospec.h>
 #include <linux/io_uring.h>
 
 #include <uapi/linux/io_uring.h>
@@ -107,6 +108,9 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 
                sqe = &ctx->sq_sqes[sq_idx << sq_shift];
                opcode = READ_ONCE(sqe->opcode);
+               if (opcode >= IORING_OP_LAST)
+                       continue;
+               opcode = array_index_nospec(opcode, IORING_OP_LAST);
                if (sq_shift) {
                        sqe128 = true;
                } else if (io_issue_defs[opcode].is_128) {