diff options
| author | saturneric <[email protected]> | 2025-11-16 14:34:50 +0000 |
|---|---|---|
| committer | saturneric <[email protected]> | 2025-11-16 14:34:50 +0000 |
| commit | 690862a8d74fee1e07f33dad44b761753f101779 (patch) | |
| tree | f81bdcab8cd5a640518dba5056de6c62bd071eaf /io_uring/rsrc.c | |
| parent | Merge tag 'v6.17.7' into linux-6.17.y (diff) | |
| parent | Linux 6.17.8 (diff) | |
| download | kernel-linux-6.17.y.tar.gz kernel-linux-6.17.y.zip | |
Merge tag 'v6.17.8' into linux-6.17.ylinux-6.17.y
This is the 6.17.8 stable release
Diffstat (limited to 'io_uring/rsrc.c')
| -rw-r--r-- | io_uring/rsrc.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index f75f5e43fa4a..5961f21dd65d 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg) if (src_ctx != ctx) { mutex_unlock(&ctx->uring_lock); lock_two_rings(ctx, src_ctx); + + if (src_ctx->submitter_task && + src_ctx->submitter_task != current) { + ret = -EEXIST; + goto out; + } } ret = io_clone_buffers(ctx, src_ctx, &buf); +out: if (src_ctx != ctx) mutex_unlock(&src_ctx->uring_lock); @@ -1395,8 +1402,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs, size_t max_segs = 0; unsigned i; - for (i = 0; i < nr_iovs; i++) + for (i = 0; i < nr_iovs; i++) { max_segs += (iov[i].iov_len >> shift) + 2; + if (max_segs > INT_MAX) + return -EOVERFLOW; + } return max_segs; } @@ -1502,7 +1512,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, if (unlikely(ret)) return ret; } else { - nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu); + int ret = io_estimate_bvec_size(iov, nr_iovs, imu); + + if (ret < 0) + return ret; + nr_segs = ret; } if (sizeof(struct bio_vec) > sizeof(struct iovec)) { |