diff options
| author | Dylan Yudaken <dylany@fb.com> | 2022-06-13 03:11:56 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-06-13 05:13:31 -0600 |
| commit | c6e9fa5c0ab811f4bec36a96337f4b1bb77d142c (patch) | |
| tree | cf78b3f306d8af65117425aeeb3f70b550d884f7 | |
| parent | 97da4a537924d87e2261773f3ac9365abb191fc9 (diff) | |
| download | staging-c6e9fa5c0ab811f4bec36a96337f4b1bb77d142c.tar.gz | |
io_uring: fix types in provided buffer ring
The type of head needs to match that of tail in order for rollover and
comparisons to work correctly.
Without this change the comparison of tail to head might incorrectly allow
io_uring to use a buffer that userspace had not given it.
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220613101157.3687-3-dylany@fb.com
Reviewed-by: Hao Xu <howeyxu@tencent.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | fs/io_uring.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 9cf9aff51b70d1..6eea18e8330c8e 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -298,8 +298,8 @@ struct io_buffer_list { /* below is for ring provided buffers */ __u16 buf_nr_pages; __u16 nr_entries; - __u32 head; - __u32 mask; + __u16 head; + __u16 mask; }; struct io_buffer { @@ -3876,7 +3876,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, { struct io_uring_buf_ring *br = bl->buf_ring; struct io_uring_buf *buf; - __u32 head = bl->head; + __u16 head = bl->head; if (unlikely(smp_load_acquire(&br->tail) == head)) { io_ring_submit_unlock(req->ctx, issue_flags); |