diff options
| author | Pavel Begunkov <[email protected]> | 2025-11-07 18:41:26 +0000 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2025-11-08 00:17:13 +0000 |
| commit | 146eb58629f45f8297e83d69e64d4eea4b28d972 (patch) | |
| tree | 535b9a688444edf6b4cba37695920c3370473d48 /security/selinux/include/class_to_string.h | |
| parent | io_uring: fix types for region size calulation (diff) | |
| download | kernel-146eb58629f45f8297e83d69e64d4eea4b28d972.tar.gz kernel-146eb58629f45f8297e83d69e64d4eea4b28d972.zip | |
io_uring: fix regbuf vector size truncation
There is a report of io_estimate_bvec_size() truncating the calculated
number of segments that leads to corruption issues. Check it doesn't
overflow "int"s used later. Rough but simple, can be improved on top.
Cc: [email protected]
Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
Reported-by: Google Big Sleep <[email protected]>
Signed-off-by: Pavel Begunkov <[email protected]>
Reviewed-by: Günther Noack <[email protected]>
Tested-by: Günther Noack <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Diffstat (limited to 'security/selinux/include/class_to_string.h')
0 files changed, 0 insertions, 0 deletions