Re: [PATCH] io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
Jens Axboe <[email protected]> Mon, 03 Aug 2026 20:17:15 -0600
| Newsgroups | org.kernel.vger.io-uring,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <178580983549.518281.3281041637140008411.b4-ty@b4> |
On Sun, 02 Aug 2026 16:30:30 +0000, Ali Ahmet Memis wrote:
> io_vec_fill_bvec() computes the folio size with a plain int 1:
>
> unsigned long folio_size = 1 << imu->folio_shift;
>
> imu->folio_shift is unsigned int and comes from folio_shift() of the
> folio backing the registered buffer, so it can be 32 or more on a 64 bit
> kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the
> count is taken modulo 32, so a shift of 34 yields 4 rather than 16G.
> Every other folio_shift shift in this file already uses 1UL.
>
> [...]
Applied, thanks!
[1/1] io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
commit: 3f3a6a16bbe8bde76532d9415438f8cdef439e5d
Best regards,
--
Jens Axboe