• Jens Axboe's avatar
    io_uring/kbuf: sanitize peek buffer setup · e0ee9676
    Jens Axboe authored
    Harden the buffer peeking a bit, by adding a sanity check for it having
    a valid size. Outside of that, arg->max_len is a size_t, though it's
    only ever set to a 32-bit value (as it's governed by MAX_RW_COUNT).
    Bump our needed check to a size_t so we know it fits. Finally, cap the
    calculated needed iov value to the PEEK_MAX_IMPORT, which is the
    maximum number of segments that should be peeked.
    
    Fixes: 35c8711c ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    e0ee9676
kbuf.c 20.4 KB