[PATCH 1/1] io_uring: regbuf vector size truncation

[PATCH 1/1] io_uring: regbuf vector size truncation

[Pavel Begunkov]

There is a report of io_estimate_bvec_size() truncating the calculated
number of segments that leads to corruption issues. Check it doesn't
overflow "int"s used later. Rough but simple, can be improved on top.

Cc: stable@vger.kernel.org
Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/rsrc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 4053d104bf4c..a49dcbae11f0 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1405,8 +1405,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
 	size_t max_segs = 0;
 	unsigned i;
 
-	for (i = 0; i < nr_iovs; i++)
+	for (i = 0; i < nr_iovs; i++) {
 		max_segs += (iov[i].iov_len >> shift) + 2;
+		if (max_segs > INT_MAX)
+			return -EOVERFLOW;
+	}
 	return max_segs;
 }
 
@@ -1512,7 +1515,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
 		if (unlikely(ret))
 			return ret;
 	} else {
-		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
+		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
+
+		if (ret < 0)
+			return ret;
+		nr_segs = ret;
 	}
 
 	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
-- 
2.49.0

Re: [PATCH 1/1] io_uring: regbuf vector size truncation

[Pavel Begunkov]

On 11/7/25 18:41, Pavel Begunkov wrote:

Should be "_fix_ regbuf vector size truncation" in the subject,
but I guess it doesn't matter.

> There is a report of io_estimate_bvec_size() truncating the calculated
> number of segments that leads to corruption issues. Check it doesn't
> overflow "int"s used later. Rough but simple, can be improved on top.
> 
> Cc: stable@vger.kernel.org
> Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
> Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
-- 
Pavel Begunkov

Re: [PATCH 1/1] io_uring: regbuf vector size truncation

[Günther Noack]

On Fri, Nov 07, 2025 at 06:41:26PM +0000, Pavel Begunkov wrote:
> There is a report of io_estimate_bvec_size() truncating the calculated
> number of segments that leads to corruption issues. Check it doesn't
> overflow "int"s used later. Rough but simple, can be improved on top.
> 
> Cc: stable@vger.kernel.org
> Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers")
> Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-458654612@google.com>
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  io_uring/rsrc.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index 4053d104bf4c..a49dcbae11f0 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -1405,8 +1405,11 @@ static int io_estimate_bvec_size(struct iovec *iov, unsigned nr_iovs,
>  	size_t max_segs = 0;
>  	unsigned i;
>  
> -	for (i = 0; i < nr_iovs; i++)
> +	for (i = 0; i < nr_iovs; i++) {
>  		max_segs += (iov[i].iov_len >> shift) + 2;
> +		if (max_segs > INT_MAX)
> +			return -EOVERFLOW;
> +	}
>  	return max_segs;
>  }
>  
> @@ -1512,7 +1515,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
>  		if (unlikely(ret))
>  			return ret;
>  	} else {
> -		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
> +		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
> +
> +		if (ret < 0)
> +			return ret;
> +		nr_segs = ret;
>  	}
>  
>  	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
> -- 
> 2.49.0
> 

I reviewed the logic and the check looks correct,
and I tested that it works as expected.

(Minor remark: You might want to annotate the conditions as unlikely()?)

Reviewed-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>

—Günther

Re: [PATCH 1/1] io_uring: regbuf vector size truncation

[Jens Axboe]

On Fri, 07 Nov 2025 18:41:26 +0000, Pavel Begunkov wrote:
> There is a report of io_estimate_bvec_size() truncating the calculated
> number of segments that leads to corruption issues. Check it doesn't
> overflow "int"s used later. Rough but simple, can be improved on top.
> 
> 

Applied, thanks!

[1/1] io_uring: regbuf vector size truncation
      (no commit info)

Best regards,
-- 
Jens Axboe

Re: [PATCH 1/1] io_uring: regbuf vector size truncation

[Pavel Begunkov]

On 11/7/25 21:14, Günther Noack wrote:
...>> @@ -1512,7 +1515,11 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter,
>>   		if (unlikely(ret))
>>   			return ret;
>>   	} else {
>> -		nr_segs = io_estimate_bvec_size(iov, nr_iovs, imu);
>> +		int ret = io_estimate_bvec_size(iov, nr_iovs, imu);
>> +
>> +		if (ret < 0)
>> +			return ret;
>> +		nr_segs = ret;
>>   	}
>>   
>>   	if (sizeof(struct bio_vec) > sizeof(struct iovec)) {
>> -- 
>> 2.49.0
>>
> 
> I reviewed the logic and the check looks correct,
> and I tested that it works as expected.
> 
> (Minor remark: You might want to annotate the conditions as unlikely()?)

FWIW, it doesn't really matter here, the check can be optimised
out by moving more of the sanitisation logic earlier, but that's
for later.

> Reviewed-by: Günther Noack <gnoack@google.com>
> Tested-by: Günther Noack <gnoack@google.com>

Great, thanks

-- 
Pavel Begunkov