Commit 489270f4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-6.11-20240823' of git://git.kernel.dk/linux 

Pull io_uring fix from Jens Axboe:
 "Just a single fix for provided buffer validation"

* tag 'io_uring-6.11-20240823' of git://git.kernel.dk/linux:
  io_uring/kbuf: sanitize peek buffer setup
parents b09f6ca9 e0ee9676

io_uring/kbuf.c

+6 −3
Original line number Diff line number Diff line
@@ -218,10 +218,13 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, 


	buf = io_ring_head_to_buf(br, head, bl->mask);

	if (arg->max_len) {

		int needed;

		u32 len = READ_ONCE(buf->len);

		size_t needed;



		needed = (arg->max_len + buf->len - 1) / buf->len;

		needed = min(needed, PEEK_MAX_IMPORT);

		if (unlikely(!len))

			return -ENOBUFS;

		needed = (arg->max_len + len - 1) / len;

		needed = min_not_zero(needed, (size_t) PEEK_MAX_IMPORT);

		if (nr_avail > needed)

			nr_avail = needed;

	}