Pull io_uring fix from Jens Axboe: "Single fix in there, fixing an overflow in calculating the needed segments for converting into a bvec array" * tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix regbuf vector size truncation
Unified · Split
| @@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs, · 1402 unmodified lines | ||
| 1403 | 1403 | size_t max_segs = 0; |
| 1404 | 1404 | unsigned i; |
| 1405 | 1405 | |
| 1406 | − for (i = 0; i < nr_iovs; i++) | |
| 1406 | + for (i = 0; i < nr_iovs; i++) { | |
| 1407 | 1407 | max_segs += (iov[i].iov_len >> shift) + 2; |
| 1408 | + if (max_segs > INT_MAX) | |
| 1409 | + return -EOVERFLOW; | |
| 1410 | + } | |
| 1408 | 1411 | return max_segs; |
| 1409 | 1412 | } |
| 1410 | 1413 | |
| @@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, · 99 unmodified lines | ||
| 1510 | 1513 | if (unlikely(ret)) |
| 1511 | 1514 | return ret; |
| 1512 | 1515 | } else { |
| 1513 | − nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu); | |
| 1516 | + int ret = io_estimate_bvec_size(iov, nr_iovs, imu); | |
| 1517 | + | |
| 1518 | + if (ret < 0) | |
| 1519 | + return ret; | |
| 1520 | + nr_segs = ret; | |
| 1514 | 1521 | } |
| 1515 | 1522 | |
| 1516 | 1523 | if (sizeof(struct bio_vec) > sizeof(struct iovec)) { |