From: Pavel Begunkov Date: Mon, 2 Mar 2026 13:10:34 +0000 (+0000) Subject: io_uring/timeout: check unused sqe fields X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=484ae637a3e3d909718de7c07afd3bb34b6b8504;p=thirdparty%2Fkernel%2Flinux.git io_uring/timeout: check unused sqe fields Zero check unused SQE fields addr3 and pad2 for timeout and timeout update requests. They're not needed now, but could be used sometime in the future. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe --- diff --git a/io_uring/timeout.c b/io_uring/timeout.c index cb61d4862fc65..e3815e3465dde 100644 --- a/io_uring/timeout.c +++ b/io_uring/timeout.c @@ -449,6 +449,8 @@ int io_timeout_remove_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT))) return -EINVAL; + if (sqe->addr3 || sqe->__pad2[0]) + return -EINVAL; if (sqe->buf_index || sqe->len || sqe->splice_fd_in) return -EINVAL; @@ -521,6 +523,8 @@ static int __io_timeout_prep(struct io_kiocb *req, unsigned flags; u32 off = READ_ONCE(sqe->off); + if (sqe->addr3 || sqe->__pad2[0]) + return -EINVAL; if (sqe->buf_index || sqe->len != 1 || sqe->splice_fd_in) return -EINVAL; if (off && is_timeout_link)