dlan17/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Browse Source 
Pull io_uring fix from Jens Axboe:
 "Single fix in there, fixing an overflow in calculating the needed
  segments for converting into a bvec array"

* tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix regbuf vector size truncation
This commit is contained in:
Linus Torvalds
2025-11-08 08:47:31 -08:00
parent e284d5118a 146eb58629
commit 3636cfa745
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
io_uring/rsrc.c
+9 -2
View File
@@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
size_t max_segs = 0;
unsigned i;
for (i = 0; i < nr_iovs; i++)
for (i = 0; i < nr_iovs; i++) {
max_segs += (iov[i].iov_len >> shift) + 2;
if (max_segs > INT_MAX)
return -EOVERFLOW;
}
return max_segs;
}
@@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
if (unlikely(ret))
return ret;
} else {
nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
if (ret < 0)
return ret;
nr_segs = ret;
}
if (sizeof(struct bio_vec) > sizeof(struct iovec)) {