MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

io_uring/register: cache old SQ/CQ head reading for copies

Browse Source 
The SQ and CQ ring heads are read twice - once for verifying that it's
within bounds, and once inside the loops copying SQE and CQE entries.
This is technically incorrect, in case the values could get modified
in between verifying them and using them in the copy loop. While this
won't lead to anything truly nefarious, it may cause longer loop times
for the copies than expected.

Read the ring head values once, and use the verified value in the copy
loops.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jens Axboe 2025-01-15 08:39:15 -07:00
parent 2c5aae129f
commit 6f7a644eb7
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
io_uring/register.c
View File

@ -405,8 +405,8 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
{
struct io_ring_ctx_rings o = { }, n = { }, *to_free = NULL;
size_t size, sq_array_offset;
unsigned i, tail, old_head;
struct io_uring_params p;
unsigned i, tail;
void *ptr;
int ret;
@ -518,9 +518,10 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
*/
n.sq_sqes = ptr;
tail = READ_ONCE(o.rings->sq.tail);
if (tail - READ_ONCE(o.rings->sq.head) > p.sq_entries)
old_head = READ_ONCE(o.rings->sq.head);
if (tail - old_head > p.sq_entries)
goto overflow;
for (i = READ_ONCE(o.rings->sq.head); i < tail; i++) {
for (i = old_head; i < tail; i++) {
unsigned src_head = i & (ctx->sq_entries - 1);
unsigned dst_head = i & (p.sq_entries - 1);
@ -530,7 +531,8 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)
WRITE_ONCE(n.rings->sq.tail, READ_ONCE(o.rings->sq.tail));
tail = READ_ONCE(o.rings->cq.tail);
if (tail - READ_ONCE(o.rings->cq.head) > p.cq_entries) {
old_head = READ_ONCE(o.rings->cq.head);
if (tail - old_head > p.cq_entries) {
overflow:
/* restore old rings, and return -EOVERFLOW via cleanup path */
ctx->rings = o.rings;
@ -539,7 +541,7 @@ overflow:
ret = -EOVERFLOW;
goto out;
}
for (i = READ_ONCE(o.rings->cq.head); i < tail; i++) {
for (i = old_head; i < tail; i++) {
unsigned src_head = i & (ctx->cq_entries - 1);
unsigned dst_head = i & (p.cq_entries - 1);