mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 17:35:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

io_uring/rsrc: reject overflowing regvec bvec byte counts

Browse Source 
io_import_reg_vec() converts the estimated number of bio_vec entries
into iovec-sized storage when struct bio_vec is larger than struct
iovec. The conversion still multiplies nr_segs by sizeof(struct
bio_vec) in size_t without checking for overflow.

On 32-bit kernels, a registered buffer large enough to make
io_estimate_bvec_size() return 357913942 segments wraps the byte count
from 0x100000008 to 8. io_vec_realloc() then reserves only the input
iovecs plus one extra slot while io_vec_fill_bvec() writes the full
bio_vec array.

Check both the multiplication and the rounding addition before
deriving the replacement iovec count.

Fixes: b4e41050b2 ("io_uring/rsrc: raise registered buffer 1GB limit")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260812203042.720348-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jérémy Jean
2026-08-12 20:30:42 +00:00
committed by Jens Axboe
parent bc0e8faf90
commit 6ca662cc71
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
io_uring/rsrc.c
View File

@@ -1653,8 +1653,12 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
size_t bvec_bytes;
bvec_bytes = nr_segs * sizeof(struct bio_vec);
nr_segs = (bvec_bytes + sizeof(*iov) - 1) / sizeof(*iov);
if (check_mul_overflow((size_t)nr_segs, sizeof(struct bio_vec),
&bvec_bytes) ||
check_add_overflow(bvec_bytes, sizeof(*iov) - 1,
&bvec_bytes))
return -EOVERFLOW;
nr_segs = bvec_bytes / sizeof(*iov);
nr_segs += nr_iovs;
}