io_uring/rsrc: raise registered buffer 1GB limit

There's no real reason to have a limit, as the memory is accounted by
the lockmem limits anyway, if any exist. io_pin_pages() will still
restrict the maximum allowed limit per buffer, which is INT_MAX
number of pages. Cap it a bit lower than that, at 1TB for a 64-bit
system. Surely that should be enough for everyone. For now.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index be7c5bf4e161e7fc986b0c5ca583c0050e567ad3..7f553d115e3653101d5daea88a7a19b9562cc63c 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -133,9 +133,14 @@ int io_validate_user_buf_range(u64 uaddr, u64 ulen)
        unsigned long tmp, base = (unsigned long)uaddr;
        unsigned long acct_len = (unsigned long)PAGE_ALIGN(ulen);
 
-       /* arbitrary limit, but we need something */
-       if (ulen > SZ_1G || !ulen)
+       if (!ulen)
                return -EFAULT;
+       /* 32-bit sanity checking */
+       if (ulen > ULONG_MAX || uaddr > ULONG_MAX)
+               return -EFAULT;
+       /* cap to 1TB for 64-bit */
+       if (ulen > SZ_1T)
+               return -EINVAL;
        if (check_add_overflow(base, acct_len, &tmp))
                return -EOVERFLOW;
        return 0;