io_uring/rsrc: use nospec'ed indexes

isilence · axboe · commit 953c37e066f0 · 2023-04-15T14:44:57.000-06:00
We use array_index_nospec() for registered buffer indexes, but don't use it while poking into rsrc tags, fix that. Fixes: 634d00d ("io_uring: add full-fledged dynamic buffers support") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/f02fafc5a9c0dd69be2b0618c38831c078232ff0.1681395792.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
@@ -517,7 +517,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
 		}
 
 		ctx->user_bufs[i] = imu;
-		*io_get_tag_slot(ctx->buf_data, offset) = tag;
+		*io_get_tag_slot(ctx->buf_data, i) = tag;
 	}
 
 	if (needs_switch)

Original file line number	Diff line number	Diff line change
`@@ -517,7 +517,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,`
`517`	`517`	`}`
`518`	`518`
`519`	`519`	`ctx->user_bufs[i] = imu;`
`520`		`- *io_get_tag_slot(ctx->buf_data, offset) = tag;`
	`520`	`+ *io_get_tag_slot(ctx->buf_data, i) = tag;`
`521`	`521`	`}`
`522`	`522`
`523`	`523`	`if (needs_switch)`