samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

io_uring/kbuf: reject zero sized provided buffers

Browse Source 
commit cf960726eb65e8d0bfecbcce6cf95f47b1ffa6cc upstream.

This isn't fixing a real issue, but there's also zero point in going
through group and buffer setup, when the buffers are going to be
rejected once attempted to get used.

Cc: stable@vger.kernel.org
Reported-by: syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jens Axboe
2025-04-07 07:51:23 -06:00
committed by Greg Kroah-Hartman
parent 21b0c54546
commit 35c4a652d8
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
io_uring/kbuf.c
View File

@@ -321,6 +321,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
p->nbufs = tmp; p->nbufs = tmp;
p->addr = READ_ONCE(sqe->addr); p->addr = READ_ONCE(sqe->addr);
p->len = READ_ONCE(sqe->len); p->len = READ_ONCE(sqe->len);
if (!p->len)
return -EINVAL;
if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,
&size)) &size))