6.12-stable patches

added patches:
	io_uring-kbuf-use-mem_is_zero.patch

diff --git a/queue-6.12/io_uring-kbuf-use-mem_is_zero.patch b/queue-6.12/io_uring-kbuf-use-mem_is_zero.patch
new file mode 100644 (file)
index 0000000..aca2c85
--- /dev/null
+++ b/queue-6.12/io_uring-kbuf-use-mem_is_zero.patch
@@ -0,0 +1,59 @@
+From 1724849072854a66861d461b298b04612702d685 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Tue, 13 May 2025 18:26:47 +0100
+Subject: io_uring/kbuf: use mem_is_zero()
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 1724849072854a66861d461b298b04612702d685 upstream.
+
+Make use of mem_is_zero() for reserved fields checking.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/11fe27b7a831329bcdb4ea087317ef123ba7c171.1747150490.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/kbuf.c |   14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -705,8 +705,7 @@ int io_register_pbuf_ring(struct io_ring
+ 
+       if (copy_from_user(&reg, arg, sizeof(reg)))
+               return -EFAULT;
+-
+-      if (reg.resv[0] || reg.resv[1] || reg.resv[2])
++      if (!mem_is_zero(reg.resv, sizeof(reg.resv)))
+               return -EINVAL;
+       if (reg.flags & ~(IOU_PBUF_RING_MMAP | IOU_PBUF_RING_INC))
+               return -EINVAL;
+@@ -773,9 +772,7 @@ int io_unregister_pbuf_ring(struct io_ri
+ 
+       if (copy_from_user(&reg, arg, sizeof(reg)))
+               return -EFAULT;
+-      if (reg.resv[0] || reg.resv[1] || reg.resv[2])
+-              return -EINVAL;
+-      if (reg.flags)
++      if (!mem_is_zero(reg.resv, sizeof(reg.resv)) || reg.flags)
+               return -EINVAL;
+ 
+       bl = io_buffer_get_list(ctx, reg.bgid);
+@@ -793,14 +790,11 @@ int io_register_pbuf_status(struct io_ri
+ {
+       struct io_uring_buf_status buf_status;
+       struct io_buffer_list *bl;
+-      int i;
+ 
+       if (copy_from_user(&buf_status, arg, sizeof(buf_status)))
+               return -EFAULT;
+-
+-      for (i = 0; i < ARRAY_SIZE(buf_status.resv); i++)
+-              if (buf_status.resv[i])
+-                      return -EINVAL;
++      if (!mem_is_zero(buf_status.resv, sizeof(buf_status.resv)))
++              return -EINVAL;
+ 
+       bl = io_buffer_get_list(ctx, buf_status.buf_group);
+       if (!bl)

diff --git a/queue-6.12/series b/queue-6.12/series
index afdc7ec0a1b93e004d25ea400dc2ca4528012a28..9b50ccd84f60915cb3b7b92b3697dcc1bec4e0e4 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -591,3 +591,4 @@ net-tls-fix-strparser-anchor-skb-leak-on-offload-rx-.patch
 sfc-fix-error-code-in-efx_devlink_info_running_versi.patch
 net-sched-cls_flower-revert-unintended-changes.patch
 arm64-reserve-an-extra-page-for-early-kernel-mapping.patch
+io_uring-kbuf-use-mem_is_zero.patch