Re: [PATCH] io_uring/cancel: validate opcode for IORING_ASYNC_CANCEL_OP

[Jens Axboe]

On 3/31/26 5:21 PM, Amir Mohammad Jahangirzad wrote:
> io_async_cancel_prep() reads the opcode selector from sqe->len and
> stores it in cancel->opcode, which is an 8-bit field. Since sqe->len
> is a 32-bit value, values larger than U8_MAX are implicitly truncated.
> 
> This can cause unintended opcode matches when the truncated value
> corresponds to a valid io_uring opcode. For example, submitting a value
> such as 0x10b will be truncated to 0x0b (IORING_OP_TIMEOUT), allowing a
> cancel request to match operations it did not intend to target.
> Validate the opcode value before assigning it to the 8-bit field and
> reject values outside the valid io_uring opcode range.

Looks fine to me as a cleanup, as it's really the application being
buggy if you set ->len > IORING_OP_LAST and then match some opcode
that just happens to be == ->len & 255. I'll apply this for 7.1.

-- 
Jens Axboe