Re: [PATCH] io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

Jens Axboe <[email protected]> Mon, 03 Aug 2026 20:17:15 -0600
Newsgroups org.kernel.vger.stable,org.kernel.vger.io-uring,org.kernel.vger.linux-kernel
Message-ID <178580983549.518281.3281041637140008411.b4-ty@b4>
On Sun, 02 Aug 2026 16:30:30 +0000, Ali Ahmet Memis wrote:
> io_vec_fill_bvec() computes the folio size with a plain int 1:
> 
> 	unsigned long folio_size = 1 << imu->folio_shift;
> 
> imu->folio_shift is unsigned int and comes from folio_shift() of the
> folio backing the registered buffer, so it can be 32 or more on a 64 bit
> kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the
> count is taken modulo 32, so a shift of 34 yields 4 rather than 16G.
> Every other folio_shift shift in this file already uses 1UL.
> 
> [...]

Applied, thanks!

[1/1] io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
      commit: 3f3a6a16bbe8bde76532d9415438f8cdef439e5d

Best regards,
-- 
Jens Axboe