From: Jens Axboe <axboe@kernel.dk>
Date: Thu, 18 Sep 2025 21:45:41 +0000 (-0600)
Subject: io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
X-Git-Tag: v6.12.49~36
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=695673eb5711ee5eb1769481cf1503714716a7d1;p=thirdparty%2Fkernel%2Fstable.git

io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check

Partially based on commit 98b6fa62c84f2e129161e976a5b9b3cb4ccd117b upstream.

This can be triggered by userspace, so just drop it. The condition
is appropriately handled.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/io_uring/kbuf.h b/io_uring/kbuf.h
index 2586a292dfb91..a3ad8aea45c8a 100644
--- a/io_uring/kbuf.h
+++ b/io_uring/kbuf.h
@@ -143,7 +143,7 @@ static inline bool io_kbuf_commit(struct io_kiocb *req,
 		struct io_uring_buf *buf;
 
 		buf = io_ring_head_to_buf(bl->buf_ring, bl->head, bl->mask);
-		if (WARN_ON_ONCE(len > buf->len))
+		if (len > buf->len)
 			len = buf->len;
 		buf->len -= len;
 		if (buf->len) {