io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT

io_ring_buffers_peek() builds an iovec array from provided buffers, and
that in turn can be handed off to a lower level provider. Be prudent and
cap the total size to MAX_RW_COUNT, which is the Linux default for how
much IO do to in a single call.

No bugs here, but it's a good preventative measure to avoid truncation
issues.

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bceaba30a35d69ffa5abe84e78529bac2b..1cf5be62bb6563efb678d558085773aa594279d9 100644 (file)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
        if (unlikely(!nr_avail))
                return -ENOBUFS;
 
+       /* MAX_RW_COUNT is the universal Linux per-call IO maximum */
+       arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
+
        buf = io_ring_head_to_buf(br, head, bl->mask);
        if (arg->max_len) {
                u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
        /* set it to max, if not set, so we can use it unconditionally */
        if (!arg->max_len)
-               arg->max_len = INT_MAX;
+               arg->max_len = MAX_RW_COUNT;
 
        req->buf_index = READ_ONCE(buf->bid);
        do {