Commit cf960726 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring/kbuf: reject zero sized provided buffers 



This isn't fixing a real issue, but there's also zero point in going
through group and buffer setup, when the buffers are going to be
rejected once attempted to get used.

Cc: stable@vger.kernel.org
Reported-by: default avatar <syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 5a17131a

io_uring/kbuf.c

+2 −0
Original line number Diff line number Diff line
@@ -504,6 +504,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe 
	p->nbufs = tmp;

	p->addr = READ_ONCE(sqe->addr);

	p->len = READ_ONCE(sqe->len);

	if (!p->len)

		return -EINVAL;



	if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,

				&size))