io_uring/rw: add defensive hardening for negative kbuf lengths

No real bug here, just being a bit defensive in ensuring that whatever
gets passed into io_put_kbuf() is always >= 0 and not some random error
value.

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rw.c b/io_uring/rw.c
index 20654deff84de4b045716f81c55222e1d82ba7a0..e729e0e7657ecc10b48c230db895d049b7f8ed01 100644 (file)
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -580,7 +580,7 @@ void io_req_rw_complete(struct io_tw_req tw_req, io_tw_token_t tw)
        io_req_io_end(req);
 
        if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING))
-               req->cqe.flags |= io_put_kbuf(req, req->cqe.res, NULL);
+               req->cqe.flags |= io_put_kbuf(req, max(req->cqe.res, 0), NULL);
 
        io_req_rw_cleanup(req, 0);
        io_req_task_complete(tw_req, tw);
@@ -1379,7 +1379,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
                list_del(&req->iopoll_node);
                wq_list_add_tail(&req->comp_list, &ctx->submit_state.compl_reqs);
                nr_events++;
-               req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL);
+               req->cqe.flags = io_put_kbuf(req, max(req->cqe.res, 0), NULL);
                if (!io_is_uring_cmd(req))
                        io_req_rw_cleanup(req, 0);
        }