Re: [PATCH 4/6] io_uring/rw: add defensive hardening for negative kbuf lengths

[Gabriel Krisman Bertazi <krisman@suse.de>]

Jens Axboe <axboe@kernel.dk> writes:

> No real bug here, just being a bit defensive in ensuring that whatever
> gets passed into io_put_kbuf() is always >= 0 and not some random error
> value.
>
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> ---
>  io_uring/rw.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/io_uring/rw.c b/io_uring/rw.c
> index 20654deff84d..e729e0e7657e 100644
> --- a/io_uring/rw.c
> +++ b/io_uring/rw.c
> @@ -580,7 +580,7 @@ void io_req_rw_complete(struct io_tw_req tw_req, io_tw_token_t tw)
>  	io_req_io_end(req);
>  
>  	if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING))
> -		req->cqe.flags |= io_put_kbuf(req, req->cqe.res, NULL);
> +		req->cqe.flags |= io_put_kbuf(req, max(req->cqe.res, 0), NULL);
>  
>  	io_req_rw_cleanup(req, 0);
>  	io_req_task_complete(tw_req, tw);
> @@ -1379,7 +1379,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
>  		list_del(&req->iopoll_node);
>  		wq_list_add_tail(&req->comp_list, &ctx->submit_state.compl_reqs);
>  		nr_events++;
> -		req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL);
> +		req->cqe.flags = io_put_kbuf(req, max(req->cqe.res, 0), NULL);
>  		if (!io_is_uring_cmd(req))
>  			io_req_rw_cleanup(req, 0);
>  	}

Much more readable if it were rolled as an early return inside io_put_kbuf, but clearly:

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>

-- 
Gabriel Krisman Bertazi