diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-04-20 22:16:19 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-04-21 21:19:03 +0300 |
| commit | 79968834558774bdc5de4b5503d412df632646aa (patch) | |
| tree | 8074f3bac33c235cd103a459bc91d96d5a3966ec | |
| parent | 02b8d41c17630493f63c7785c873e327fa9b76a6 (diff) | |
| download | linux-79968834558774bdc5de4b5503d412df632646aa.tar.xz | |
io_uring/rw: add defensive hardening for negative kbuf lengths
No real bug here, just being a bit defensive in ensuring that whatever
gets passed into io_put_kbuf() is always >= 0 and not some random error
value.
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/rw.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/io_uring/rw.c b/io_uring/rw.c index 20654deff84d..e729e0e7657e 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -580,7 +580,7 @@ void io_req_rw_complete(struct io_tw_req tw_req, io_tw_token_t tw) io_req_io_end(req); if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) - req->cqe.flags |= io_put_kbuf(req, req->cqe.res, NULL); + req->cqe.flags |= io_put_kbuf(req, max(req->cqe.res, 0), NULL); io_req_rw_cleanup(req, 0); io_req_task_complete(tw_req, tw); @@ -1379,7 +1379,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin) list_del(&req->iopoll_node); wq_list_add_tail(&req->comp_list, &ctx->submit_state.compl_reqs); nr_events++; - req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL); + req->cqe.flags = io_put_kbuf(req, max(req->cqe.res, 0), NULL); if (!io_is_uring_cmd(req)) io_req_rw_cleanup(req, 0); } |