io_uring: nospec index for tags on files update

isilence · axboe · commit 34bb77184123 · 2022-04-07T11:17:47.000-06:00
Don't forget to array_index_nospec() for indexes before updating rsrc tags in __io_sqe_files_update(), just use already safe and precalculated index @i. Fixes: c3bdad0 ("io_uring: add generic rsrc update with tags") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/fs/io_uring.c b/fs/io_uring.c
@@ -9094,7 +9094,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
 				err = -EBADF;
 				break;
 			}
-			*io_get_tag_slot(data, up->offset + done) = tag;
+			*io_get_tag_slot(data, i) = tag;
 			io_fixed_file_set(file_slot, file);
 			err = io_sqe_file_register(ctx, file, i);
 			if (err) {

Original file line number	Diff line number	Diff line change
`@@ -9094,7 +9094,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,`
`9094`	`9094`	`err = -EBADF;`
`9095`	`9095`	`break;`
`9096`	`9096`	`}`
`9097`		`- *io_get_tag_slot(data, up->offset + done) = tag;`
	`9097`	`+ *io_get_tag_slot(data, i) = tag;`
`9098`	`9098`	`io_fixed_file_set(file_slot, file);`
`9099`	`9099`	`err = io_sqe_file_register(ctx, file, i);`
`9100`	`9100`	`if (err) {`