From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com [209.85.208.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7D6B3B4EA5 for ; Wed, 1 Jul 2026 08:11:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782893517; cv=none; b=JaHCcTB6meJRWyCq6IdhJIq4UPejTBx0dP9gL9eCHm0bOYhxl8r8irxRNgQ9U6SbxuATsbfKMlZ/fFDLTOVfDK8f8F+2KTrj9W1hksdzmJpjJ5OsRchx+/IxQ82E91voV/pUqMnoY9eMrZxTvqxNrFHez2Umz9muvYMQdSO0EO0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782893517; c=relaxed/simple; bh=8D3HGjKY4B2nWaRqyqClM3G4Q/AKoHTj919BBG9gMug=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=RriHUfBx5uJmcTUaWrUxPiykdNuV/NToalRPGV24UNDqofirH9uh4lc5hSZ5EB0nFQ4w5TPnK5sAMndqEZ2kAxtJ7x9M9Z9Sl4sKlMslerHACp00fgXeTBMz86dmcZAlGjHH07V9xL9pZjdiG1ML1Ijmd1he8SW5K+PCsnTa4Wo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ToWtwRqb; arc=none smtp.client-ip=209.85.208.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ToWtwRqb" Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-39669bcaadfso3700001fa.0 for ; Wed, 01 Jul 2026 01:11:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782893509; x=1783498309; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2JRU5KzlpmqExlTSewb94kl93z3gGd+KqfKhU1JZClg=; b=ToWtwRqbeNSjD/wnHJsZoLnWX7QjgzlE/0j2VD+/CaXm62MMM3Si1QDSfYj7TF3kbV LNvohrVpJ3PjcIjzzxbj0nku6wlxr3vh3cbILZ63NSp40y9azmdDX3ScN+0lgTKgZ7YA 3gw/IhHDLQ26IFiP4mVkeembAmXgh+hjzjCd6jh9xrfqr8w/ngBcji/kk2Yo7j3VTwMK 2GxL41c5SpRxy46P1xB9k2GXvoWeOQYu9W2guboAy0HxFwpZFG6HoRlSvBlhClDZgqtF h8veoYozhXjtfF+aY80spvTnghXFmOzhxbtRsIZNLC5syKOT6hQ8MINAXctbnZ5u2I4r rRZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782893509; x=1783498309; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2JRU5KzlpmqExlTSewb94kl93z3gGd+KqfKhU1JZClg=; b=YUMw/8RGIt96dOGEB4LmrUV/G5fzkWvrQDd53ni3L/Qo7wgzjh/3g4jJQ0r7y9lTtP 8QyGVcb+NvMZFBeuVRhk4n6o4e3muF0fRrj3MAzmFS0Ms+Bay0ggdhsTPZt2Fg5DLw1Q kQkkR7t3Ey41L9nqdeOpP04hgVvGbtmdA+BgHVh2l5t26U1mQVB2F+VswtYlkmulY6Cc 16Qs6AKW2LbJAROrbOqMwmgCM2VkMxffBt5skXn/Kk+90VgQQEP/A2X9S9LGMVrJa2ec 3JCvDgkSvGfJZmc0OWnxTZgBOTBuyNRQbwJB4Utp6g5CO2dUdaAdWQvrW9Hu2zhxYjJt UFNQ== X-Forwarded-Encrypted: i=1; AHgh+RrUVSIvQHnvL0TgLXmrb68S/BOU6jsuR6C5Y6mvz5dydsOCiaClHp3ca733GAVQV9wRxSvuZKS3H29v3WU=@vger.kernel.org X-Gm-Message-State: AOJu0YyPotcNy7+JgUAfgn9z1I151fmUjMNzBU1wRfZPC0XDbd5Au/w/ 6LnPwnX4chZILMxPj69igGdIFypGjZ1KiK4YFR5fx517pC99yqhM/JBm X-Gm-Gg: AfdE7cmvdXZO90OfzPJ/BmaAKZUYEjZQp/FqVEWutJRj4bDb6sfzU79PeCPN4YgFdyI FgcOXYV9bJbq8mATKSOdfy1Oj/BVY6E0huKR4ueHPbXBF8Zseo7Nd9T8xVqJWs2hogEs2ywTTCm c+BoeN59ZpuK8ZUlrGXqbnPaBhFkqDf+2smwoL6ZHaZqaquw0/h5hpRnt5KsjR+PRIUFwE/4Eu4 0rCJZEGJK0JQN4qv4p9VA7zfSbqZ8sQPrNmRXjikojBbjL06BUz8nKMyXl6iIdmZRzB33Bfythn aA59g2AniZ22SunQrme4eFFmyifK9cOvj0AIaSty/BEqaSObxn1QBboOw/cnmK8rY6dQhN5UGuh x4jb9Z7vDDN2ja9Z0HLoUaI1iv0dhbOyT2SHnFd2Stm3D4FcEcxn8aEUoUsPgYSpPkwgSLjeNYs VRKmdp8G2+TYcXQjoDuNIiHENO8lW73B4= X-Received: by 2002:a2e:9296:0:b0:396:9630:5ed with SMTP id 38308e7fff4ca-39b340101afmr980441fa.15.1782893508329; Wed, 01 Jul 2026 01:11:48 -0700 (PDT) Received: from localhost.localdomain ([2a01:4f9:2a:1c13::2]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-39b2f6f9e63sm2727001fa.11.2026.07.01.01.11.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 01:11:47 -0700 (PDT) From: Melbin K Mathew To: axboe@kernel.dk Cc: io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, Melbin K Mathew Subject: [PATCH io_uring] io_uring/msg_ring: reject CQE32 flag pass-through to normal rings Date: Wed, 1 Jul 2026 10:11:45 +0200 Message-Id: <20260701081145.196730-1-mlbnkm1@gmail.com> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit IORING_OP_MSG_RING with IORING_MSG_RING_FLAGS_PASS allows a sender to pass completion flags through sqe->file_index. If the sender sets IORING_CQE_F_32 in file_index, the target-side completion path treats it as a 32-byte CQE and writes big_cqe[0] and big_cqe[1] into the CQ ring regardless of whether the target ring was created with IORING_SETUP_CQE32 or IORING_SETUP_CQE_MIXED. On a normal 16-byte CQE ring, this writes 16 extra bytes (two u64 big_cqe fields) into the next CQE slot in the ring buffer. This was confirmed by poisoning the adjacent slot with known values and observing them being overwritten after the pass-through, while the CQ tail advanced by only one slot. Add a helper io_msg_ring_cqe_flags() that validates the flags before they are forwarded, and use it in both the local and remote data paths. Reject with -EINVAL when IORING_CQE_F_32 is passed to a ring that does not support CQE32 or mixed CQE modes. In the remote path, this guard runs before the target request allocation to avoid a leak on error. Fixes: cbeb47a7b5f0 ("io_uring/msg_ring: Pass custom flags to the cqe") Signed-off-by: Melbin K Mathew --- Notes: Testing on Linux 7.2-rc1 with KASAN and UBSAN enabled: Unpatched kernel: MSG_RING with IORING_MSG_RING_FLAGS_PASS and IORING_CQE_F_32 posts CQE_F_32 to a normal target ring. Target CQ tail advances by one while the adjacent unpublished CQ slot is overwritten (confirmed by poisoning the adjacent slot with known values and observing them zeroed after the pass-through). Patched kernel: sender receives -EINVAL. Target CQ tail does not advance. Adjacent poisoned slot remains intact. git apply --check: OK checkpatch --strict: 0 errors, 0 warnings, 0 checks make W=1 io_uring/msg_ring.o: clean io_uring/msg_ring.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c index 3ff9098573..3067c93439 100644 --- a/io_uring/msg_ring.c +++ b/io_uring/msg_ring.c @@ -93,19 +93,38 @@ static void io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req, io_req_task_work_add_remote(req, IOU_F_TWQ_LAZY_WAKE); } +static int io_msg_ring_cqe_flags(struct io_ring_ctx *target_ctx, + const struct io_msg *msg, u32 *flags) +{ + *flags = 0; + + if (!(msg->flags & IORING_MSG_RING_FLAGS_PASS)) + return 0; + + *flags = msg->cqe_flags; + if ((*flags & IORING_CQE_F_32) && + !(target_ctx->flags & (IORING_SETUP_CQE32 | + IORING_SETUP_CQE_MIXED))) + return -EINVAL; + + return 0; +} + static int io_msg_data_remote(struct io_ring_ctx *target_ctx, struct io_msg *msg) { struct io_kiocb *target; - u32 flags = 0; + u32 flags; + int ret; - target = kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO) ; + ret = io_msg_ring_cqe_flags(target_ctx, msg, &flags); + if (ret) + return ret; + + target = kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO); if (unlikely(!target)) return -ENOMEM; - if (msg->flags & IORING_MSG_RING_FLAGS_PASS) - flags = msg->cqe_flags; - io_msg_remote_post(target_ctx, target, msg->len, flags, msg->user_data); return 0; } @@ -130,8 +149,9 @@ static int __io_msg_ring_data(struct io_ring_ctx *target_ctx, if (io_msg_need_remote(target_ctx)) return io_msg_data_remote(target_ctx, msg); - if (msg->flags & IORING_MSG_RING_FLAGS_PASS) - flags = msg->cqe_flags; + ret = io_msg_ring_cqe_flags(target_ctx, msg, &flags); + if (ret) + return ret; ret = -EOVERFLOW; if (target_ctx->flags & IORING_SETUP_IOPOLL) { -- 2.39.5