Commit 3636cfa7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull io_uring fix from Jens Axboe:
 "Single fix in there, fixing an overflow in calculating the needed
  segments for converting into a bvec array"

* tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix regbuf vector size truncation
parents e284d511 146eb586

io_uring/rsrc.c

+9 −2
Original line number Diff line number Diff line
@@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs, 
	size_t max_segs = 0;

	unsigned i;



	for (i = 0; i < nr_iovs; i++)

	for (i = 0; i < nr_iovs; i++) {

		max_segs += (iov[i].iov_len >> shift) + 2;

		if (max_segs > INT_MAX)

			return -EOVERFLOW;

	}

	return max_segs;

}
@@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, 
		if (unlikely(ret))

			return ret;

	} else {

		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);

		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);



		if (ret < 0)

			return ret;

		nr_segs = ret;

	}



	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {