From: Jens Axboe <axboe@kernel.dk>
Date: Mon, 3 Nov 2025 18:02:54 +0000 (-0700)
Subject: io_uring/rsrc: use get/put_user() for integer copy
X-Git-Tag: v6.19-rc1~169^2~39
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3615e3f7947a3c1cb15d362da921ac46d771e02c;p=thirdparty%2Fkernel%2Flinux.git

io_uring/rsrc: use get/put_user() for integer copy

It's just getting an integer from userspace, installing a file, then
copying the output direct descriptor back. No need to use the full
copy_to/from_user() for that.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index d787c16dc1c3a..4cc38eb56758a 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -454,7 +454,7 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
 		return -ENXIO;
 
 	for (done = 0; done < up->nr_args; done++) {
-		if (copy_from_user(&fd, &fds[done], sizeof(fd))) {
+		if (get_user(fd, &fds[done])) {
 			ret = -EFAULT;
 			break;
 		}
@@ -468,7 +468,7 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
 					  IORING_FILE_INDEX_ALLOC);
 		if (ret < 0)
 			break;
-		if (copy_to_user(&fds[done], &ret, sizeof(ret))) {
+		if (put_user(ret, &fds[done])) {
 			__io_close_fixed(req->ctx, issue_flags, ret);
 			ret = -EFAULT;
 			break;