torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

io_uring/zcrx: disallow user selected dmabuf offset and size

Browse Source 
zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking
a subrange into it, the dmabuf layer might be not expecting that. It
shouldn't be a problem for now, but since the zcrx dmabuf support is new
and there shouldn't be any real users, let's play safe and reject user
provided ranges into dmabufs. Also, it shouldn't be needed as userspace
should size them appropriately.

Fixes: a5c98e9424 ("io_uring/zcrx: dmabuf backed zerocopy receive")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/be899f1afed32053eb2e2079d0da241514674aca.1752443579.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2025-07-14 11:57:23 +01:00 committed by Jens Axboe
parent 9dff55ebae
commit 08ca1409c4
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
io_uring/zcrx.c
View File

@ -76,6 +76,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
int dmabuf_fd = area_reg->dmabuf_fd; int dmabuf_fd = area_reg->dmabuf_fd;
int i, ret; int i, ret;
if (off)
return -EINVAL;
if (WARN_ON_ONCE(!ifq->dev)) if (WARN_ON_ONCE(!ifq->dev))
return -EFAULT; return -EFAULT;
if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
@ -106,7 +108,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
for_each_sgtable_dma_sg(mem->sgt, sg, i) for_each_sgtable_dma_sg(mem->sgt, sg, i)
total_size += sg_dma_len(sg); total_size += sg_dma_len(sg);
if (total_size < off + len) { if (total_size != len) {
ret = -EINVAL; ret = -EINVAL;
goto err; goto err;
} }