Pull io_uring fix from Jens Axboe: "Single fix in there, fixing an overflow in calculating the needed segments for converting into a bvec array" * tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix regbuf vector size truncation
Unified · Split
| @@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs, · 1402 unmodified lines | |||
| 1403 | size_t max_segs = 0; | 1403 | size_t max_segs = 0; |
| 1404 | unsigned i; | 1404 | unsigned i; |
| 1405 | 1405 | ||
| 1406 | for (i = 0; i < nr_iovs; i++) | 1406 | for (i = 0; i < nr_iovs; i++) { |
| 1407 | max_segs += (iov[i].iov_len >> shift) + 2; | 1407 | max_segs += (iov[i].iov_len >> shift) + 2; |
| 1408 | if (max_segs > INT_MAX) | ||
| 1409 | return -EOVERFLOW; | ||
| 1410 | } | ||
| 1408 | return max_segs; | 1411 | return max_segs; |
| 1409 | } | 1412 | } |
| 1410 | 1413 | ||
| @@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, · 99 unmodified lines | |||
| 1510 | if (unlikely(ret)) | 1513 | if (unlikely(ret)) |
| 1511 | return ret; | 1514 | return ret; |
| 1512 | } else { | 1515 | } else { |
| 1513 | nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu); | 1516 | int ret = io_estimate_bvec_size(iov, nr_iovs, imu); |
| 1517 | |||
| 1518 | if (ret < 0) | ||
| 1519 | return ret; | ||
| 1520 | nr_segs = ret; | ||
| 1514 | } | 1521 | } |
| 1515 | 1522 | ||
| 1516 | if (sizeof(struct bio_vec) > sizeof(struct iovec)) { | 1523 | if (sizeof(struct bio_vec) > sizeof(struct iovec)) { |