tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring/kbuf: fix unintentional sign extension on shift of reg.bgid

Shifting reg.bgid << IORING_OFF_PBUF_SHIFT results in a promotion
from __u16 to a 32 bit signed integer, this is then sign extended
to a 64 bit unsigned long on 64 bit architectures. If reg.bgid is
greater than 0x7fff then this leads to a sign extended result where
all the upper 32 bits of mmap_offset are set to 1. Fix this by
casting reg.bgid to the same type as mmap_offset before performing
the shift.

Fixes: ef62de3c4ad5 ("io_uring/kbuf: use region api for pbuf rings")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://lore.kernel.org/r/20241204153923.401674-1-colin.i.king@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Colin Ian King and committed by
Jens Axboe febfbf76 546d1914

+1 -1
+1 -1
io_uring/kbuf.c
··· 640 640 return -ENOMEM; 641 641 } 642 642 643 - mmap_offset = reg.bgid << IORING_OFF_PBUF_SHIFT; 643 + mmap_offset = (unsigned long)reg.bgid << IORING_OFF_PBUF_SHIFT; 644 644 ring_size = flex_array_size(br, bufs, reg.ring_entries); 645 645 646 646 memset(&rd, 0, sizeof(rd));