io_uring/kbuf: reject zero sized provided buffers

commit cf960726eb65e8d0bfecbcce6cf95f47b1ffa6cc upstream.

This isn't fixing a real issue, but there's also zero point in going
through group and buffer setup, when the buffers are going to be
rejected once attempted to get used.

Cc: stable@vger.kernel.org
Reported-by: syzbot+58928048fd1416f1457c@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index e1895952066eeb43d0fc12e28370f80c044bcaff..7a8c3a004800ed341931076e9456c8051bf6c85a 100644 (file)
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -484,6 +484,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
        p->nbufs = tmp;
        p->addr = READ_ONCE(sqe->addr);
        p->len = READ_ONCE(sqe->len);
+       if (!p->len)
+               return -EINVAL;
 
        if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,
                                &size))