summaryrefslogtreecommitdiff
path: root/io_uring
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2022-08-23 07:26:08 -0600
committerJens Axboe <axboe@kernel.dk>2022-08-23 07:26:08 -0600
commit47abea041f897d64dbd5777f0cf7745148f85d75 (patch)
tree12da1cc86a67e9ae113af1f5942a5a72e8765fc5 /io_uring
parente1d0c6d05afdcff01ace698edb3b8808db1dc066 (diff)
downloadlwn-47abea041f897d64dbd5777f0cf7745148f85d75.tar.gz
lwn-47abea041f897d64dbd5777f0cf7745148f85d75.zip
io_uring: fix off-by-one in sync cancelation file check
The passed in index should be validated against the number of registered files we have, it needs to be smaller than the index value to avoid going one beyond the end. Fixes: 78a861b94959 ("io_uring: add sync cancelation API through io_uring_register()") Reported-by: Luo Likang <luolikang@nsfocus.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
-rw-r--r--io_uring/cancel.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index e4e1dc0325f0..5fc5d3e80fcb 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -218,7 +218,7 @@ static int __io_sync_cancel(struct io_uring_task *tctx,
(cd->flags & IORING_ASYNC_CANCEL_FD_FIXED)) {
unsigned long file_ptr;
- if (unlikely(fd > ctx->nr_user_files))
+ if (unlikely(fd >= ctx->nr_user_files))
return -EBADF;
fd = array_index_nospec(fd, ctx->nr_user_files);
file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr;