From: Jens Axboe Date: Mon, 7 Apr 2025 13:51:23 +0000 (-0600) Subject: io_uring/kbuf: reject zero sized provided buffers X-Git-Tag: v6.15-rc2~25^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cf960726eb65e8d0bfecbcce6cf95f47b1ffa6cc;p=thirdparty%2Flinux.git io_uring/kbuf: reject zero sized provided buffers This isn't fixing a real issue, but there's also zero point in going through group and buffer setup, when the buffers are going to be rejected once attempted to get used. Cc: stable@vger.kernel.org Reported-by: syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com Signed-off-by: Jens Axboe --- diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 0981092596713..953d5e7425691 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -504,6 +504,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe p->nbufs = tmp; p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); + if (!p->len) + return -EINVAL; if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, &size))