Re: [PATCH v9 10/13] io_uring/rsrc: extend buffer update

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] io_uring: silent 32-bit truncation of __u64 uaddr and size in io_sqe_buffer_register
--

commit a910d9c1c59f845e8a642099135fc16862f3fe7d
Author: Pavel Begunkov <asml.silence@gmail.com>

io_uring/rsrc: extend buffer update

We need to pass more information to buffer registration than we can fit
into a single struct iovec. This patch allows users to optionally pass
struct io_uring_regbuf_desc, introducing an extended registration format
with a new flags field and types.

> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index da767b34eb553..83a7ad9f5bc78 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c

[ ... ]

> @@ -882,8 +894,13 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
>  	struct io_imu_folio_data data;
>  	bool coalesced = false;
>  
> -	if (!uaddr) {
> -		if (size)
> +	if (desc->type >= __IO_REGBUF_TYPE_MAX)
> +		return ERR_PTR(-EINVAL);
> +	if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)) || desc->flags)
> +		return ERR_PTR(-EINVAL);
> +
> +	if (desc->type == IO_REGBUF_TYPE_EMPTY) {
> +		if (uaddr || size)

[Severity: Medium]
Does this code silently truncate 64-bit user input on 32-bit platforms?

The new struct io_uring_regbuf_desc defines uaddr and size as __u64:

struct io_uring_regbuf_desc {
...
	__u64 size;
	__u64 uaddr;
};

At the start of io_sqe_buffer_register(), these fields are immediately cast 
to unsigned long and size_t:

static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
						   struct io_uring_regbuf_desc *desc)
{
	unsigned long uaddr = (unsigned long)desc->uaddr;
	size_t size = desc->size;

On 32-bit platforms, this drops the upper 32 bits before any validation
occurs.

If userspace passes 0x100000000 alongside IO_REGBUF_TYPE_EMPTY, the
truncated uaddr and size evaluate to 0.

Would this allow an invalid 64-bit address to pass the emptiness check
and incorrectly bypass the -EFAULT error path?

>  			return ERR_PTR(-EFAULT);
>  		/* remove the buffer without installing a new one */
>  		return NULL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1791336930.git.asml.silence@gmail.com?part=10