Re: [PATCH] io_uring: propagate array_index_nospec opcode into req->opcode
Keith Busch <[email protected]>
| Newsgroups | org.kernel.vger.io-uring,org.kernel.vger.bpf,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <agc_m0rN3MN7ttAY@kbusch-mbp> |
On Fri, May 15, 2026 at 10:58:11AM -0400, Michael Bommarito wrote: > The compiled change is one instruction (a single mov of the clamped > byte to req->opcode); the cmp/sbb/and clamp triplet is unchanged. > No functional change: array_index_nospec() is a no-op for opcodes in > [0, IORING_OP_LAST), and out-of-range opcodes are still rejected at > the bounds check above this assignment. Since the bounds check above already catches an invalid opcode, why does it need to be re-initialized to the clamped value? Surely it's already the same value if we've taken this path, no?