[PATCH] io_uring/rsrc: remove registered buffer 1GB limit

[Jens Axboe <axboe@kernel.dk>]

There's no real reason to have a limit, as the memory is accounted by
the lockmem limits anyway, if any exist. io_pin_pages() will still
restrict the maximum allowed limit per buffer, which is INT_MAX
number of pages. For a 4kb page size system, the limit is 8TB.

Reported-by: Andres Freund <andres@anarazel.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/io_uring/memmap.c b/io_uring/memmap.c
index 4f9b439319c4..74149b1cae5c 100644
--- a/io_uring/memmap.c
+++ b/io_uring/memmap.c
@@ -53,7 +53,7 @@ struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages)
 	nr_pages = end - start;
 	if (WARN_ON_ONCE(!nr_pages))
 		return ERR_PTR(-EINVAL);
-	if (WARN_ON_ONCE(nr_pages > INT_MAX))
+	if (nr_pages > INT_MAX)
 		return ERR_PTR(-EOVERFLOW);
 
 	pages = kvmalloc_objs(struct page *, nr_pages, GFP_KERNEL_ACCOUNT);
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 650303626be6..0b85b35bfe08 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -88,8 +88,14 @@ int io_validate_user_buf_range(u64 uaddr, u64 ulen)
 	unsigned long tmp, base = (unsigned long)uaddr;
 	unsigned long acct_len = (unsigned long)PAGE_ALIGN(ulen);
 
-	/* arbitrary limit, but we need something */
-	if (ulen > SZ_1G || !ulen)
+	/*
+	 * No specific buffer length limit outside of what io_pin_pages()
+	 * limits us to.
+	 */
+	if (!ulen)
+		return -EFAULT;
+	/* 32-bit sanity checking */
+	if (ulen > ULONG_MAX || uaddr > ULONG_MAX)
 		return -EFAULT;
 	if (check_add_overflow(base, acct_len, &tmp))
 		return -EOVERFLOW;

-- 
Jens Axboe