From: Jens Axboe Date: Mon, 7 Apr 2025 13:51:23 +0000 (-0600) Subject: io_uring/kbuf: reject zero sized provided buffers X-Git-Tag: v6.1.135~185 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=be562a7f7f16c31e7301def6a7c62e79104e832b;p=thirdparty%2Fkernel%2Fstable.git io_uring/kbuf: reject zero sized provided buffers commit cf960726eb65e8d0bfecbcce6cf95f47b1ffa6cc upstream. This isn't fixing a real issue, but there's also zero point in going through group and buffer setup, when the buffers are going to be rejected once attempted to get used. Cc: stable@vger.kernel.org Reported-by: syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 55902303d7dc5..147ada2ce7472 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -336,6 +336,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe p->nbufs = tmp; p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); + if (!p->len) + return -EINVAL; if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs, &size))