Commit e1d7727b authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: don't assume uaddr alignment in io_vec_fill_bvec 



There is no guaranteed alignment for user pointers. Don't use mask
trickery and adjust the offset by bv_offset.

Cc: stable@vger.kernel.org
Reported-by: default avatarDavid Hildenbrand <david@redhat.com>
Fixes: 9ef4cbbc ("io_uring: add infra for importing vectored reg buffers")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/io-uring/19530391f5c361a026ac9b401ff8e123bde55d98.1750771718.git.asml.silence@gmail.com/


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 3a3c6d61

io_uring/rsrc.c

+7 −3
Original line number Diff line number Diff line
@@ -1339,7 +1339,6 @@ static int io_vec_fill_bvec(int ddir, struct iov_iter *iter, 
{

	unsigned long folio_size = 1 << imu->folio_shift;

	unsigned long folio_mask = folio_size - 1;

	u64 folio_addr = imu->ubuf & ~folio_mask;

	struct bio_vec *res_bvec = vec->bvec;

	size_t total_len = 0;

	unsigned bvec_idx = 0;
@@ -1361,8 +1360,13 @@ static int io_vec_fill_bvec(int ddir, struct iov_iter *iter, 
		if (unlikely(check_add_overflow(total_len, iov_len, &total_len)))

			return -EOVERFLOW;



		/* by using folio address it also accounts for bvec offset */

		offset = buf_addr - folio_addr;

		offset = buf_addr - imu->ubuf;

		/*

		 * Only the first bvec can have non zero bv_offset, account it

		 * here and work with full folios below.

		 */

		offset += imu->bvec[0].bv_offset;



		src_bvec = imu->bvec + (offset >> imu->folio_shift);

		offset &= folio_mask;