Wojciech Lukowicz <wlukowicz01@xxxxxxxxx> writes:
> Using struct_size() to calculate the size of io_uring_buf_ring will sum
> the size of the struct and of the bufs array. However, the struct's fields
> are overlaid with the array making the calculated size larger than it
> should be.
>
> When registering a ring with N * PAGE_SIZE / sizeof(struct io_uring_buf)
> entries, i.e. with fully filled pages, the calculated size will span one
> more page than it should and io_uring will try to pin the following page.
> Depending on how the application allocated the ring, it might succeed
> using an unrelated page or fail returning EFAULT.
>
> The size of the ring should be the product of ring_entries and the size
> of io_uring_buf, i.e. the size of the bufs array only.
>
> Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
> Signed-off-by: Wojciech Lukowicz <wlukowicz01@xxxxxxxxx>
Makes sense to me and tested. Feel free to add
Reviewed-by: Gabriel Krisman Bertazi <krisman@xxxxxxx>
> ---
> I'll send a liburing test shortly.
>
> io_uring/kbuf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
> index 4a6401080c1f..3002dc827195 100644
> --- a/io_uring/kbuf.c
> +++ b/io_uring/kbuf.c
> @@ -505,7 +505,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
> }
>
> pages = io_pin_pages(reg.ring_addr,
> - struct_size(br, bufs, reg.ring_entries),
> + flex_array_size(br, bufs, reg.ring_entries),
> &nr_pages);
> if (IS_ERR(pages)) {
> kfree(free_bl);
--
Gabriel Krisman Bertazi
