io_uring/net: simplify compat selbuf iov parsing

Use copy_from_user() instead of open coded access_ok() + get_user(),
that's simpler and we don't care about compat that much.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e51f9c323a3cd4ad7c8da656559bdf6237f052fb.1740569495.git.asml.silence@gmail.com
[axboe: fold in bogus < 0 check for tmp_iov.iov_len]
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/net.c b/io_uring/net.c
index c78edfd5085ee545df096c613ec82344d14087d1..dc15698647995f5c63f44f22132b42f248301148 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -215,21 +215,17 @@ static int io_compat_msg_copy_hdr(struct io_kiocb *req,
 
        uiov = compat_ptr(msg->msg_iov);
        if (req->flags & REQ_F_BUFFER_SELECT) {
-               compat_ssize_t clen;
-
                if (msg->msg_iovlen == 0) {
                        sr->len = iov->iov_len = 0;
                        iov->iov_base = NULL;
                } else if (msg->msg_iovlen > 1) {
                        return -EINVAL;
                } else {
-                       if (!access_ok(uiov, sizeof(*uiov)))
-                               return -EFAULT;
-                       if (__get_user(clen, &uiov->iov_len))
+                       struct compat_iovec tmp_iov;
+
+                       if (copy_from_user(&tmp_iov, uiov, sizeof(tmp_iov)))
                                return -EFAULT;
-                       if (clen < 0)
-                               return -EINVAL;
-                       sr->len = clen;
+                       sr->len = tmp_iov.iov_len;
                }
 
                return 0;