Commit 08ca1409 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring/zcrx: disallow user selected dmabuf offset and size 



zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking
a subrange into it, the dmabuf layer might be not expecting that. It
shouldn't be a problem for now, but since the zcrx dmabuf support is new
and there shouldn't be any real users, let's play safe and reject user
provided ranges into dmabufs. Also, it shouldn't be needed as userspace
should size them appropriately.

Fixes: a5c98e94 ("io_uring/zcrx: dmabuf backed zerocopy receive")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/be899f1afed32053eb2e2079d0da241514674aca.1752443579.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9dff55eb

io_uring/zcrx.c

+3 −1
Original line number Diff line number Diff line
@@ -76,6 +76,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, 
	int dmabuf_fd = area_reg->dmabuf_fd;

	int i, ret;



	if (off)

		return -EINVAL;

	if (WARN_ON_ONCE(!ifq->dev))

		return -EFAULT;

	if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
@@ -106,7 +108,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, 
	for_each_sgtable_dma_sg(mem->sgt, sg, i)

		total_size += sg_dma_len(sg);



	if (total_size < off + len) {

	if (total_size != len) {

		ret = -EINVAL;

		goto err;

	}