From: Pavel Begunkov <asml.silence@gmail.com>
To: "Günther Noack" <gnoack@google.com>
Cc: io-uring@vger.kernel.org, axboe@kernel.dk,
Google Big Sleep
<big-sleep-vuln-reports+bigsleep-458654612@google.com>
Subject: Re: [PATCH 1/1] io_uring: regbuf vector size truncation
Date: Mon, 10 Nov 2025 12:19:22 +0000 [thread overview]
Message-ID: <1c2c9bac-cb24-414d-a6ee-1456534d3e2d@gmail.com> (raw)
In-Reply-To: <aQ5hTIBM0euPZGnD@google.com>
On 11/7/25 21:14, Günther Noack wrote:
...>> @@ -1512,7 +1515,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
>> if (unlikely(ret))
>> return ret;
>> } else {
>> - nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
>> + int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
>> +
>> + if (ret < 0)
>> + return ret;
>> + nr_segs = ret;
>> }
>>
>> if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
>> --
>> 2.49.0
>>
>
> I reviewed the logic and the check looks correct,
> and I tested that it works as expected.
>
> (Minor remark: You might want to annotate the conditions as unlikely()?)
FWIW, it doesn't really matter here, the check can be optimised
out by moving more of the sanitisation logic earlier, but that's
for later.
> Reviewed-by: Günther Noack <gnoack@google.com>
> Tested-by: Günther Noack <gnoack@google.com>
Great, thanks
--
Pavel Begunkov
next prev parent reply other threads:[~2025-11-10 12:19 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-07 18:41 [PATCH 1/1] io_uring: regbuf vector size truncation Pavel Begunkov
2025-11-07 18:43 ` Pavel Begunkov
2025-11-07 21:14 ` Günther Noack
2025-11-10 12:19 ` Pavel Begunkov [this message]
2025-11-08 0:17 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1c2c9bac-cb24-414d-a6ee-1456534d3e2d@gmail.com \
--to=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=big-sleep-vuln-reports+bigsleep-458654612@google.com \
--cc=gnoack@google.com \
--cc=io-uring@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).