Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Single fix in there, fixing an overflow in calculating the needed
segments for converting into a bvec array"
* tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix regbuf vector size truncation
+9
-2
+9
-2
io_uring/rsrc.c
+9
-2
io_uring/rsrc.c
···
1403
1403
size_t max_segs = 0;
1404
1404
unsigned i;
1405
1405
1406
-
for (i = 0; i < nr_iovs; i++)
1406
+
for (i = 0; i < nr_iovs; i++) {
1407
1407
max_segs += (iov[i].iov_len >> shift) + 2;
1408
+
if (max_segs > INT_MAX)
1409
+
return -EOVERFLOW;
1410
+
}
1408
1411
return max_segs;
1409
1412
}
1410
1413
···
1513
1510
if (unlikely(ret))
1514
1511
return ret;
1515
1512
} else {
1516
-
nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
1513
+
int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
1514
+
1515
+
if (ret < 0)
1516
+
return ret;
1517
+
nr_segs = ret;
1517
1518
}
1518
1519
1519
1520
if (sizeof(struct bio_vec) > sizeof(struct iovec)) {