A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
the last CQ array slot with a dummy entry and make the tail wrap around.

However, malicious userspace can directly set IORING_CQE_F_32 on the last
CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
half from beyond the CQ array. Change __io_uring_show_fdinfo() to
explicitly ignore the IORING_CQE_F_32 flag in this case.

This is not a real bugfix, just tightening the code a bit, because:

1. the number of CQE slots is always a power of 2, see io_uring_fill_params
2. the ring_region region consists of:
    - a 64-byte header
    - pow(2, N) CQE slots (each 0x10 bytes)
    - optionally, the SQ array
3. the ring_region size must be page-aligned because it is shared memory

Together, these properties imply that the last CQE slot can't be close
before the end of a page, so the "out-of-bounds" data is in memory
that is anyway accessible to userspace.

Reported-by: Dominik Maier <dmnk+artist@google.com>
Fixes: 82ceb7fcc5ff ("io_uring/fdinfo: handle mixed sized CQEs")
Cc: stable+noautosel@kernel.org # no impact due to memory layout
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jann Horn <jannh@google.com>
---
Changes in v2:
- fix half-completed sentence in commit description
- add Reviewed-by (Gabriel)
- add comment (Gabriel)
- Link to v1: https://patch.msgid.link/20260911-uring-fdinfo-tighten-v1-1-47c62a154aca@google.com
---
 io_uring/fdinfo.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index 3ae4804765b9..882dd7f39902 100644
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -155,9 +155,18 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 	for (i = 0; i < cq_entries; i++) {
 		struct io_uring_cqe *cqe;
 		bool cqe32 = false;
+		bool is_last_cqarray_slot = (cq_head == cq_mask);
 
 		cqe = &r->cqes[(cq_head & cq_mask)];
-		if (cqe->flags & IORING_CQE_F_32 || ctx->flags & IORING_SETUP_CQE32)
+		/*
+		 * Userspace can manipulate the last cqarray slot to have
+		 * IORING_CQE_F_32 set, which would cause the second half of
+		 * that CQE to be read out of bounds.
+		 * Ignore the flag for the last cqarray slot, which can't
+		 * legitimately have the flag set.
+		 */
+		if ((cqe->flags & IORING_CQE_F_32 || ctx->flags & IORING_SETUP_CQE32) &&
+		    !is_last_cqarray_slot)
 			cqe32 = true;
 		seq_printf(m, "%5u: user_data:%llu, res:%d, flags:%x",
 			   cq_head & cq_mask, cqe->user_data, cqe->res,

---
base-commit: 50d05c7c76c96b90462f24debacca971d2e86713
change-id: 20260910-uring-fdinfo-tighten-1b1c18945305

Best regards,
--  
Jann Horn <jannh@google.com>

On Fri, 11 Sep 2026 19:56:13 +0200, Jann Horn wrote:
> A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
> contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
> the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
> the last CQ array slot with a dummy entry and make the tail wrap around.
> 
> However, malicious userspace can directly set IORING_CQE_F_32 on the last
> CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
> half from beyond the CQ array. Change __io_uring_show_fdinfo() to
> explicitly ignore the IORING_CQE_F_32 flag in this case.
> 
> [...]

Applied, thanks!

[1/1] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot
      commit: ab394388d05977f369e8e8d1beceae47fc3c5e72

Best regards,
-- 
Jens Axboe

On 9/11/26 12:03 PM, Jens Axboe wrote:
> 
> On Fri, 11 Sep 2026 19:56:13 +0200, Jann Horn wrote:
>> A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
>> contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
>> the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
>> the last CQ array slot with a dummy entry and make the tail wrap around.
>>
>> However, malicious userspace can directly set IORING_CQE_F_32 on the last
>> CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
>> half from beyond the CQ array. Change __io_uring_show_fdinfo() to
>> explicitly ignore the IORING_CQE_F_32 flag in this case.
>>
>> [...]
> 
> Applied, thanks!
> 
> [1/1] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot
>       commit: ab394388d05977f369e8e8d1beceae47fc3c5e72

Back at it, and wanted to move this to 7.4, as there's no point
expediting it for 7.3. While doing so, I took another look. And
cq_head is the raw ring counter, not a masked index. Hence I think:

bool is_last_cqarray_slot = (cq_head == cq_mask);

this is incorrect, as it won't work past the very first run around the
ring. I fixed it up as:

bool is_last_cqarray_slot = (cq_head & cq_mask) == cq_mask;

Just a heads up! Let me know if you disagree or want to send a v3
instead.

-- 
Jens Axboe

On Mon, Sep 21, 2026 at 6:45 PM Jens Axboe <axboe@kernel.dk> wrote:
> On 9/11/26 12:03 PM, Jens Axboe wrote:
> > On Fri, 11 Sep 2026 19:56:13 +0200, Jann Horn wrote:
> >> A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
> >> contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
> >> the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
> >> the last CQ array slot with a dummy entry and make the tail wrap around.
> >>
> >> However, malicious userspace can directly set IORING_CQE_F_32 on the last
> >> CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
> >> half from beyond the CQ array. Change __io_uring_show_fdinfo() to
> >> explicitly ignore the IORING_CQE_F_32 flag in this case.
> >>
> >> [...]
> >
> > Applied, thanks!
> >
> > [1/1] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot
> >       commit: ab394388d05977f369e8e8d1beceae47fc3c5e72
>
> Back at it, and wanted to move this to 7.4, as there's no point
> expediting it for 7.3. While doing so, I took another look. And
> cq_head is the raw ring counter, not a masked index. Hence I think:
>
> bool is_last_cqarray_slot = (cq_head == cq_mask);
>
> this is incorrect, as it won't work past the very first run around the
> ring. I fixed it up as:
>
> bool is_last_cqarray_slot = (cq_head & cq_mask) == cq_mask;
>
> Just a heads up! Let me know if you disagree or want to send a v3
> instead.

Ah, bleh, of course, my bad. Thanks for catching that!