io_uring: fix regbuf vector size truncation

There is a report of io_estimate_bvec_size() truncating the calculated
number of segments that leads to corruption issues. Check it doesn't
overflow "int"s used later. Rough but simple, can be improved on top.

Cc: stable@vger.kernel.org
Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index d787c16dc1c3a273c758c43414d7313c54066672..2602d76d5ff0e58b70a7cab73279c224f47b63c4 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1403,8 +1403,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
        size_t max_segs = 0;
        unsigned i;
 
-       for (i = 0; i < nr_iovs; i++)
+       for (i = 0; i < nr_iovs; i++) {
                max_segs += (iov[i].iov_len >> shift) + 2;
+               if (max_segs > INT_MAX)
+                       return -EOVERFLOW;
+       }
        return max_segs;
 }
 
@@ -1510,7 +1513,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
                if (unlikely(ret))
                        return ret;
        } else {
-               nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
+               int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
+
+               if (ret < 0)
+                       return ret;
+               nr_segs = ret;
        }
 
        if (sizeof(struct bio_vec) > sizeof(struct iovec)) {