Re: [PATCH 1/1] io_uring: regbuf vector size truncation

["Günther Noack" <gnoack@google.com>]

On Fri, Nov 07, 2025 at 06:41:26PM +0000, Pavel Begunkov wrote:
> There is a report of io_estimate_bvec_size() truncating the calculated
> number of segments that leads to corruption issues. Check it doesn't
> overflow "int"s used later. Rough but simple, can be improved on top.
> 
> Cc: stable@vger.kernel.org
> Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
> Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  io_uring/rsrc.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index 4053d104bf4c..a49dcbae11f0 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1405,8 +1405,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
>  	size_t max_segs = 0;
>  	unsigned i;
>  
> -	for (i = 0; i < nr_iovs; i++)
> +	for (i = 0; i < nr_iovs; i++) {
>  		max_segs += (iov[i].iov_len >> shift) + 2;
> +		if (max_segs > INT_MAX)
> +			return -EOVERFLOW;
> +	}
>  	return max_segs;
>  }
>  
> @@ -1512,7 +1515,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
>  		if (unlikely(ret))
>  			return ret;
>  	} else {
> -		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
> +		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
> +
> +		if (ret < 0)
> +			return ret;
> +		nr_segs = ret;
>  	}
>  
>  	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
> -- 
> 2.49.0
> 

I reviewed the logic and the check looks correct,
and I tested that it works as expected.

(Minor remark: You might want to annotate the conditions as unlikely()?)

Reviewed-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>

—Günther