git
/
linux
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

io_uring/query: cap number of queries 

If a query chain forms a cycle, it'll be looping in the kernel until the
process is killed. It might be fine as any such mistake can be easily
uncovered during testing, but it's still nicer to let it break out of
the syscall if it executed too many queries.

Suggested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2025-09-19 12:11:57 +01:00 committed by Jens Axboe
parent 2408d17832
commit 7ea24326e7
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
io_uring/query.c
View File

@ -6,6 +6,7 @@
#include "io_uring.h"
#define IO_MAX_QUERY_SIZE (sizeof(struct io_uring_query_opcode))
#define IO_MAX_QUERY_ENTRIES 1000
static ssize_t io_query_ops(void *data)
{
@ -74,7 +75,7 @@ int io_query(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
{
char entry_buffer[IO_MAX_QUERY_SIZE];
void __user *uhdr = arg;
int ret;
int ret, nr = 0;
memset(entry_buffer, 0, sizeof(entry_buffer));
@ -89,6 +90,9 @@ int io_query(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
return ret;
uhdr = u64_to_user_ptr(next_hdr);
/* Have some limit to avoid a potential cycle */
if (++nr >= IO_MAX_QUERY_ENTRIES)
return -ERANGE;
if (fatal_signal_pending(current))
return -EINTR;
cond_resched();