superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

io_uring/rsrc: check size when importing reg buffer 

We're relying on callers to verify the IO size, do it inside of
io_import_fixed() instead. It's safer, easier to deal with, and more
consistent as now it's done close to the iter init site.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/f9c2c75ec4d356a0c61289073f68d98e8a9db190.1743446271.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
pull/1194/head
Pavel Begunkov 2025-03-31 19:40:21 +01:00 committed by Jens Axboe
parent ed344511c5
commit a1fbe0a121
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
io_uring/rsrc.c
View File

@ -1016,6 +1016,8 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
/* not inside the mapped region */ /* not inside the mapped region */
if (unlikely(buf_addr < imu->ubuf || buf_end > (imu->ubuf + imu->len))) if (unlikely(buf_addr < imu->ubuf || buf_end > (imu->ubuf + imu->len)))
return -EFAULT; return -EFAULT;
if (unlikely(len > MAX_RW_COUNT))
return -EFAULT;
if (!(imu->dir & (1 << ddir))) if (!(imu->dir & (1 << ddir)))
return -EFAULT; return -EFAULT;