Pavel Begunkov 146eb58629 io_uring: fix regbuf vector size truncation ...

There is a report of io_estimate_bvec_size() truncating the calculated
number of segments that leads to corruption issues. Check it doesn't
overflow "int"s used later. Rough but simple, can be improved on top.

Cc: stable@vger.kernel.org
Fixes: 9ef4cbbcb4 ("io_uring: add infra for importing vectored reg buffers")
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

2025-11-07 17:17:13 -07:00

..

advise.c

…

advise.h

…

alloc_cache.c

…

alloc_cache.h

…

cancel.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

cancel.h

…

cmd_net.c

io_uring/uring_cmd: add support for IORING_SETUP_CQE_MIXED

2025-08-27 11:24:15 -06:00

epoll.c

…

epoll.h

…

eventfd.c

…

eventfd.h

…

fdinfo.c

io_uring/sqpoll: switch away from getrusage() for CPU accounting

2025-10-22 10:51:20 -06:00

fdinfo.h

…

filetable.c

io_uring: correct __must_hold annotation in io_install_fixed_file

2025-10-23 07:25:07 -06:00

filetable.h

…

fs.c

…

fs.h

…

futex.c

io_uring: add async data clear/free helpers

2025-08-27 11:24:25 -06:00

futex.h

…

io_uring.c

io_uring: Fix code indentation error

2025-10-22 10:56:11 -06:00

io_uring.h

Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 09:56:23 -07:00

io-wq.c

io_uring/io-wq: fix max_workers breakage and nr_workers underflow

2025-09-15 10:46:13 -06:00

io-wq.h

…

kbuf.c

io_uring: fix buffer auto-commit for multishot uring_cmd

2025-10-23 19:41:31 -06:00

kbuf.h

io-uring: move struct io_br_sel into io_uring_types.h

2025-08-24 11:41:12 -06:00

Kconfig

…

Makefile

io_uring: introduce io_uring querying

2025-09-08 08:06:37 -06:00

memmap.c

io_uring: fix types for region size calulation

2025-11-05 11:45:07 -07:00

memmap.h

…

mock_file.c

io_uring/mock: add trivial poll handler

2025-07-02 08:10:26 -06:00

msg_ring.c

io_uring/msg_ring: kill alloc_cache for io_kiocb allocations

2025-09-18 13:59:15 -06:00

msg_ring.h

…

napi.c

…

napi.h

…

net.c

io_uring: Fix code indentation error

2025-10-22 10:56:11 -06:00

net.h

…

nop.c

io_uring/nop: add support for IORING_SETUP_CQE_MIXED

2025-08-27 11:24:15 -06:00

nop.h

…

notif.c

Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 09:56:23 -07:00

notif.h

…

opdef.c

io_uring: uring_cmd: add multishot support

2025-08-24 11:41:12 -06:00

opdef.h

…

openclose.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

openclose.h

…

poll.c

Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 09:56:23 -07:00

poll.h

…

query.c

io_uring/query: cap number of queries

2025-09-19 07:06:43 -06:00

query.h

io_uring: introduce io_uring querying

2025-09-08 08:06:37 -06:00

refs.h

…

register.c

io_uring/zcrx: remove sync refill uapi

2025-11-03 08:55:58 -07:00

register.h

…

rsrc.c

io_uring: fix regbuf vector size truncation

2025-11-07 17:17:13 -07:00

rsrc.h

io_uring: export io_[un]account_mem

2025-07-16 16:23:28 -06:00

rw.c

io_uring/rw: check for NULL io_br_sel when putting a buffer

2025-10-15 13:38:53 -06:00

rw.h

…

slist.h

…

splice.c

io_uring: don't include filetable.h in io_uring.h

2025-09-08 13:20:46 -06:00

splice.h

…

sqpoll.c

io_uring/sqpoll: be smarter on when to update the stime usage

2025-10-22 10:55:33 -06:00

sqpoll.h

io_uring/sqpoll: switch away from getrusage() for CPU accounting

2025-10-22 10:51:20 -06:00

statx.c

…

statx.h

…

sync.c

…

sync.h

…

tctx.c

…

tctx.h

…

timeout.c

io_uring: include dying ring in task_work "should cancel" state

2025-09-18 10:24:50 -06:00

timeout.h

…

truncate.c

…

truncate.h

…

uring_cmd.c

Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 09:56:23 -07:00

uring_cmd.h

io_uring/cmd: remove struct io_uring_cmd_data

2025-07-18 12:34:56 -06:00

waitid.c

io_uring: fix incorrect unlikely() usage in io_waitid_prep()

2025-10-20 09:22:09 -06:00

waitid.h

…

xattr.c

…

xattr.h

…

zcrx.c

io_uring/zcrx: remove sync refill uapi

2025-11-03 08:55:58 -07:00

zcrx.h

io_uring/zcrx: remove sync refill uapi

2025-11-03 08:55:58 -07:00