Re: [PATCH v2] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot

[Jens Axboe]

On 9/11/26 12:03 PM, Jens Axboe wrote:
> 
> On Fri, 11 Sep 2026 19:56:13 +0200, Jann Horn wrote:
>> A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
>> contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
>> the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
>> the last CQ array slot with a dummy entry and make the tail wrap around.
>>
>> However, malicious userspace can directly set IORING_CQE_F_32 on the last
>> CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
>> half from beyond the CQ array. Change __io_uring_show_fdinfo() to
>> explicitly ignore the IORING_CQE_F_32 flag in this case.
>>
>> [...]
> 
> Applied, thanks!
> 
> [1/1] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot
>       commit: ab394388d05977f369e8e8d1beceae47fc3c5e72

Back at it, and wanted to move this to 7.4, as there's no point
expediting it for 7.3. While doing so, I took another look. And
cq_head is the raw ring counter, not a masked index. Hence I think:

bool is_last_cqarray_slot = (cq_head == cq_mask);

this is incorrect, as it won't work past the very first run around the
ring. I fixed it up as:

bool is_last_cqarray_slot = (cq_head & cq_mask) == cq_mask;

Just a heads up! Let me know if you disagree or want to send a v3
instead.

-- 
Jens Axboe