Re: [PATCH] io_uring: fix size calculation when registering buf ring

[Gabriel Krisman Bertazi <krisman@suse.de>]

Wojciech Lukowicz <wlukowicz01@gmail.com> writes:

> Using struct_size() to calculate the size of io_uring_buf_ring will sum
> the size of the struct and of the bufs array. However, the struct's fields
> are overlaid with the array making the calculated size larger than it
> should be.
>
> When registering a ring with N * PAGE_SIZE / sizeof(struct io_uring_buf)
> entries, i.e. with fully filled pages, the calculated size will span one
> more page than it should and io_uring will try to pin the following page.
> Depending on how the application allocated the ring, it might succeed
> using an unrelated page or fail returning EFAULT.
>
> The size of the ring should be the product of ring_entries and the size
> of io_uring_buf, i.e. the size of the bufs array only.
>
> Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
> Signed-off-by: Wojciech Lukowicz <wlukowicz01@gmail.com>

Makes sense to me and tested. Feel free to add

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>


> ---
> I'll send a liburing test shortly.
>
>  io_uring/kbuf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
> index 4a6401080c1f..3002dc827195 100644
> --- a/io_uring/kbuf.c
> +++ b/io_uring/kbuf.c
> @@ -505,7 +505,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
>  	}
>  
>  	pages = io_pin_pages(reg.ring_addr,
> -			     struct_size(br, bufs, reg.ring_entries),
> +			     flex_array_size(br, bufs, reg.ring_entries),
>  			     &nr_pages);
>  	if (IS_ERR(pages)) {
>  		kfree(free_bl);

-- 
Gabriel Krisman Bertazi