Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

3636cfa7 · Linus Torvalds <[email protected]> · 2025-11-08 08:47:31 -08:00

Pull io_uring fix from Jens Axboe:
 "Single fix in there, fixing an overflow in calculating the needed
  segments for converting into a bvec array"

* tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix regbuf vector size truncation

Commit: 3636cfa745e6a4ff0142e29068750439059867b0
Parents: e284d511 · 146eb586

Merge commit. Changes below are compared with the first parent: e284d511.

Changes

1 files changed · +9 −2

File	Status	Add	Del	Content
io_uring/rsrc.c	modified	+9	−2	View file

io_uring/rsrc.c

View file

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index d787c16..2602d76 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
 	size_t max_segs = 0;
 	unsigned i;
 
-	for (i = 0; i < nr_iovs; i++)
+	for (i = 0; i < nr_iovs; i++) {
 		max_segs += (iov[i].iov_len >> shift) + 2;
+		if (max_segs > INT_MAX)
+			return -EOVERFLOW;
+	}
 	return max_segs;
 }
 
@@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
 		if (unlikely(ret))
 			return ret;
 	} else {
-		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
+		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
+
+		if (ret < 0)
+			return ret;
+		nr_segs = ret;
 	}
 
 	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {