Commit a1fbe0a1 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring/rsrc: check size when importing reg buffer 



We're relying on callers to verify the IO size, do it inside of
io_import_fixed() instead. It's safer, easier to deal with, and more
consistent as now it's done close to the iter init site.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/f9c2c75ec4d356a0c61289073f68d98e8a9db190.1743446271.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent ed344511

io_uring/rsrc.c

+2 −0
Original line number Diff line number Diff line
@@ -1016,6 +1016,8 @@ static int io_import_fixed(int ddir, struct iov_iter *iter, 
	/* not inside the mapped region */

	if (unlikely(buf_addr < imu->ubuf || buf_end > (imu->ubuf + imu->len)))

		return -EFAULT;

	if (unlikely(len > MAX_RW_COUNT))

		return -EFAULT;

	if (!(imu->dir & (1 << ddir)))

		return -EFAULT;