From: Jérémy Jean Date: Wed, 12 Aug 2026 20:30:42 +0000 (+0000) Subject: io_uring/rsrc: reject overflowing regvec bvec byte counts X-Git-Tag: v7.2~9^2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=6ca662cc71df7eb4eaf1b4bcb07cd3f188ad19f2;p=thirdparty%2Fkernel%2Fstable.git io_uring/rsrc: reject overflowing regvec bvec byte counts io_import_reg_vec() converts the estimated number of bio_vec entries into iovec-sized storage when struct bio_vec is larger than struct iovec. The conversion still multiplies nr_segs by sizeof(struct bio_vec) in size_t without checking for overflow. On 32-bit kernels, a registered buffer large enough to make io_estimate_bvec_size() return 357913942 segments wraps the byte count from 0x100000008 to 8. io_vec_realloc() then reserves only the input iovecs plus one extra slot while io_vec_fill_bvec() writes the full bio_vec array. Check both the multiplication and the rounding addition before deriving the replacement iovec count. Fixes: b4e41050b212 ("io_uring/rsrc: raise registered buffer 1GB limit") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean Link: https://patch.msgid.link/20260812203042.720348-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jens Axboe --- diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 8d0f2ee24e0c2..98dccefd801b9 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1653,8 +1653,12 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, if (sizeof(struct bio_vec) > sizeof(struct iovec)) { size_t bvec_bytes; - bvec_bytes = nr_segs * sizeof(struct bio_vec); - nr_segs = (bvec_bytes + sizeof(*iov) - 1) / sizeof(*iov); + if (check_mul_overflow((size_t)nr_segs, sizeof(struct bio_vec), + &bvec_bytes) || + check_add_overflow(bvec_bytes, sizeof(*iov) - 1, + &bvec_bytes)) + return -EOVERFLOW; + nr_segs = bvec_bytes / sizeof(*iov); nr_segs += nr_iovs; }