io_uring: fix failure to verify SQ_AFF cpu

The test case we have is rightfully failing with the current kernel:

io_uring_setup(1, 0x7ffe2cafebe0), flags: IORING_SETUP_SQPOLL|IORING_SETUP_SQ_AFF, resv: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000, sq_thread_cpu: 4
expected -1, got 3

This is in a vm, and CPU3 is the last valid one, hence asking for 4
should fail the setup with -EINVAL, not succeed. The problem is that
we're using array_index_nospec() with nr_cpu_ids as the index, hence we
wrap and end up using CPU0 instead of CPU4. This makes the setup
succeed where it should be failing.

We don't need to use array_index_nospec() as we're not indexing any
array with this. Instead just compare with nr_cpu_ids directly. This
is fine as we're checking with cpu_online() afterwards.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 576d9c652b4cc757c252ef75b38e1b7708f91182..249a1e4e60e6375a7e820f4a2921eafa0665d2fc 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2454,10 +2454,11 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
                        ctx->sq_thread_idle = HZ;
 
                if (p->flags & IORING_SETUP_SQ_AFF) {
-                       int cpu = array_index_nospec(p->sq_thread_cpu,
-                                                       nr_cpu_ids);
+                       int cpu = p->sq_thread_cpu;
 
                        ret = -EINVAL;
+                       if (cpu >= nr_cpu_ids)
+                               goto err;
                        if (!cpu_online(cpu))
                                goto err;