Pavel Begunkov 146eb58629 io_uring: fix regbuf vector size truncation ... There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top. Cc: stable@vger.kernel.org Fixes: 9ef4cbbcb4 ("io_uring: add infra for importing vectored reg buffers") Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Günther Noack <gnoack@google.com> Tested-by: Günther Noack <gnoack@google.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2025-11-07 17:17:13 -07:00
..
Kconfig	…
Makefile	io_uring: introduce io_uring querying	2025-09-08 08:06:37 -06:00
advise.c	…
advise.h	…
alloc_cache.c	…
alloc_cache.h	…
cancel.c	io_uring: don't include filetable.h in io_uring.h	2025-09-08 13:20:46 -06:00
cancel.h	…
cmd_net.c	io_uring/uring_cmd: add support for IORING_SETUP_CQE_MIXED	2025-08-27 11:24:15 -06:00
epoll.c	…
epoll.h	…
eventfd.c	…
eventfd.h	…
fdinfo.c	io_uring/sqpoll: switch away from getrusage() for CPU accounting	2025-10-22 10:51:20 -06:00
fdinfo.h	…
filetable.c	io_uring: correct __must_hold annotation in io_install_fixed_file	2025-10-23 07:25:07 -06:00
filetable.h	…
fs.c	…
fs.h	…
futex.c	io_uring: add async data clear/free helpers	2025-08-27 11:24:25 -06:00
futex.h	…
io-wq.c	io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow	2025-09-15 10:46:13 -06:00
io-wq.h	…
io_uring.c	io_uring: Fix code indentation error	2025-10-22 10:56:11 -06:00
io_uring.h	for-6.18/io_uring-20250929	2025-10-02 09:56:23 -07:00
kbuf.c	io_uring: fix buffer auto-commit for multishot uring_cmd	2025-10-23 19:41:31 -06:00
kbuf.h	io-uring: move `struct io_br_sel` into io_uring_types.h	2025-08-24 11:41:12 -06:00
memmap.c	io_uring: fix types for region size calulation	2025-11-05 11:45:07 -07:00
memmap.h	…
mock_file.c	…
msg_ring.c	io_uring/msg_ring: kill alloc_cache for io_kiocb allocations	2025-09-18 13:59:15 -06:00
msg_ring.h	…
napi.c	…
napi.h	…
net.c	io_uring: Fix code indentation error	2025-10-22 10:56:11 -06:00
net.h	…
nop.c	io_uring/nop: add support for IORING_SETUP_CQE_MIXED	2025-08-27 11:24:15 -06:00
nop.h	…
notif.c	for-6.18/io_uring-20250929	2025-10-02 09:56:23 -07:00
notif.h	…
opdef.c	io_uring: uring_cmd: add multishot support	2025-08-24 11:41:12 -06:00
opdef.h	…
openclose.c	io_uring: don't include filetable.h in io_uring.h	2025-09-08 13:20:46 -06:00
openclose.h	…
poll.c	for-6.18/io_uring-20250929	2025-10-02 09:56:23 -07:00
poll.h	…
query.c	io_uring/query: cap number of queries	2025-09-19 07:06:43 -06:00
query.h	io_uring: introduce io_uring querying	2025-09-08 08:06:37 -06:00
refs.h	…
register.c	io_uring/zcrx: remove sync refill uapi	2025-11-03 08:55:58 -07:00
register.h	…
rsrc.c	io_uring: fix regbuf vector size truncation	2025-11-07 17:17:13 -07:00
rsrc.h	io_uring: export io_[un]account_mem	2025-07-16 16:23:28 -06:00
rw.c	io_uring/rw: check for NULL io_br_sel when putting a buffer	2025-10-15 13:38:53 -06:00
rw.h	…
slist.h	…
splice.c	io_uring: don't include filetable.h in io_uring.h	2025-09-08 13:20:46 -06:00
splice.h	…
sqpoll.c	io_uring/sqpoll: be smarter on when to update the stime usage	2025-10-22 10:55:33 -06:00
sqpoll.h	io_uring/sqpoll: switch away from getrusage() for CPU accounting	2025-10-22 10:51:20 -06:00
statx.c	…
statx.h	…
sync.c	…
sync.h	…
tctx.c	…
tctx.h	…
timeout.c	io_uring: include dying ring in task_work "should cancel" state	2025-09-18 10:24:50 -06:00
timeout.h	…
truncate.c	…
truncate.h	…
uring_cmd.c	for-6.18/io_uring-20250929	2025-10-02 09:56:23 -07:00
uring_cmd.h	io_uring/cmd: remove struct io_uring_cmd_data	2025-07-18 12:34:56 -06:00
waitid.c	io_uring: fix incorrect unlikely() usage in io_waitid_prep()	2025-10-20 09:22:09 -06:00
waitid.h	…
xattr.c	…
xattr.h	…
zcrx.c	io_uring/zcrx: remove sync refill uapi	2025-11-03 08:55:58 -07:00
zcrx.h	io_uring/zcrx: remove sync refill uapi	2025-11-03 08:55:58 -07:00