io_uring/zcrx: disallow user selected dmabuf offset and size

zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking
a subrange into it, the dmabuf layer might be not expecting that. It
shouldn't be a problem for now, but since the zcrx dmabuf support is new
and there shouldn't be any real users, let's play safe and reject user
provided ranges into dmabufs. Also, it shouldn't be needed as userspace
should size them appropriately.

Fixes: a5c98e9424573 ("io_uring/zcrx: dmabuf backed zerocopy receive")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/be899f1afed32053eb2e2079d0da241514674aca.1752443579.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 67c518d22e0c788bbe72cf3c11a9613edb1fe24b..e3eef4ee4454889b8b9dd19997000a5c6ac64acd 100644 (file)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -76,6 +76,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
        int dmabuf_fd = area_reg->dmabuf_fd;
        int i, ret;
 
+       if (off)
+               return -EINVAL;
        if (WARN_ON_ONCE(!ifq->dev))
                return -EFAULT;
        if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
@@ -106,7 +108,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
        for_each_sgtable_dma_sg(mem->sgt, sg, i)
                total_size += sg_dma_len(sg);
 
-       if (total_size < off + len) {
+       if (total_size != len) {
                ret = -EINVAL;
                goto err;
        }