Re: [PATCH v4 11/14] io_uring/rsrc: extend buffer update
Anuj Gupta/Anuj Gupta <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,dev.linux.lists.dm-devel,dev.linux.lists.nvdimm,org.freedesktop.lists.dri-devel,org.infradead.lists.linux-nvme,org.kernel.vger.ceph-devel,org.kernel.vger.io-uring,org.kernel.vger.linux-block,org.kernel.vger.linux-btrfs,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On 7/29/2026 2:59 AM, Pavel Begunkov wrote:
> @@ -882,8 +894,13 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
> struct io_imu_folio_data data;
> bool coalesced = false;
>
> - if (!uaddr) {
> - if (size)
> + if (desc->type >= __IO_REGBUF_TYPE_MAX)
> + return ERR_PTR(-EINVAL);
> + if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)))
> + return ERR_PTR(-EINVAL);
desc->flags isn't validated here, unlike __resv. nonzero flags should
be rejected too?
> +
> + if (desc->type == IO_REGBUF_TYPE_EMPTY) {
> + if (uaddr || size)
> return ERR_PTR(-EFAULT);
> /* remove the buffer without installing a new one */
> return NULL;