Skip to content

Commit

Permalink
io_uring/kbuf: reject zero sized provided buffers
Browse files Browse the repository at this point in the history
This isn't fixing a real issue, but there's also zero point in going
through group and buffer setup, when the buffers are going to be
rejected once attempted to get used.

Cc: stable@vger.kernel.org
Reported-by: syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
  • Loading branch information
Jens Axboe committed Apr 7, 2025
1 parent 5a17131 commit cf96072
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions io_uring/kbuf.c
Original file line number Diff line number Diff line change
Expand Up @@ -504,6 +504,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
p->nbufs = tmp;
p->addr = READ_ONCE(sqe->addr);
p->len = READ_ONCE(sqe->len);
if (!p->len)
return -EINVAL;

if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,
&size))
Expand Down

0 comments on commit cf96072

Please sign in to comment.