Re: [PATCH] io_uring: propagate array_index_nospec opcode into req->opcode

[Jens Axboe]

On 5/16/26 1:05 PM, Jens Axboe wrote:
> 
> On Fri, 15 May 2026 10:58:11 -0400, Michael Bommarito wrote:
>> Commit 1e988c3fe126 ("io_uring: prevent opcode speculation") added
>> array_index_nospec() to the local opcode in io_init_req(), but the
>> sanitised value is not written back to req->opcode.  The
>> unconditional write at the top of io_init_req() stores the raw byte
>> into the persistent field; the success path of the bounds check
>> leaves it unchanged, and downstream consumers read the raw value.
>>
>> [...]
> 
> Applied, thanks!
> 
> [1/1] io_uring: propagate array_index_nospec opcode into req->opcode
>       (no commit info)

Oops, was just applied for review, nothing has been applied. Awaiting
a v2 based on the feedback.

-- 
Jens Axboe