Re: [PATCH] io_uring/rsrc: reject overflowing regvec bvec byte counts

On Wed, 12 Aug 2026 20:30:42 +0000, Jérémy Jean wrote:
> io_import_reg_vec() converts the estimated number of bio_vec entries
> into iovec-sized storage when struct bio_vec is larger than struct
> iovec. The conversion still multiplies nr_segs by sizeof(struct
> bio_vec) in size_t without checking for overflow.
> 
> On 32-bit kernels, a registered buffer large enough to make
> io_estimate_bvec_size() return 357913942 segments wraps the byte count
> from 0x100000008 to 8. io_vec_realloc() then reserves only the input
> iovecs plus one extra slot while io_vec_fill_bvec() writes the full
> bio_vec array.
> 
> [...]

Applied, thanks!

[1/1] io_uring/rsrc: reject overflowing regvec bvec byte counts
      commit: 6ca662cc71df7eb4eaf1b4bcb07cd3f188ad19f2

Best regards,
-- 
Jens Axboe