Re: [PATCH] io_uring/rsrc: bound io_coalesce_buffer() page array allocation

---

Hi Yi,

On Tue, 30 Jun 2026 at 15:10 +0800, Yi Xie wrote:
> kvmalloc_objs() in io_coalesce_buffer() does not check for size overflow
> when nr_folios is large.  Mirror the check used in memmap.c before
> allocating the page pointer array.

Thanks for the patch. I don't think this check is needed on the current call path.

io_coalesce_buffer() is only called from io_sqe_buffer_register() after
io_pin_pages() succeeds. io_pin_pages() already rejects:

	nr_pages > INT_MAX / sizeof(struct page *)

io_check_coalesce_buffer() only increments nr_folios when it walks across
folio boundaries in the pinned page array, so we always have:

	nr_folios <= nr_pages

Thanks,
Yang Xiuwei