[PATCH] io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT

[PATCH] io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT

[Jens Axboe]

io_ring_buffers_peek() builds an iovec array from provided buffers, and
that in turn can be handed off to a lower level provider. Be prudent and
cap the total size to MAX_RW_COUNT, which is the Linux default for how
much IO do to in a single call.

No bugs here, but it's a good preventative measure to avoid truncation
issues.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bceaba..1cf5be62bb65 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 	if (unlikely(!nr_avail))
 		return -ENOBUFS;
 
+	/* MAX_RW_COUNT is the universal Linux per-call IO maximum */
+	arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
+
 	buf = io_ring_head_to_buf(br, head, bl->mask);
 	if (arg->max_len) {
 		u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
 	/* set it to max, if not set, so we can use it unconditionally */
 	if (!arg->max_len)
-		arg->max_len = INT_MAX;
+		arg->max_len = MAX_RW_COUNT;
 
 	req->buf_index = READ_ONCE(buf->bid);
 	do {

-- 
Jens Axboe

Re: [PATCH] io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT

[Gabriel Krisman Bertazi]

Jens Axboe <axboe@kernel.dk> writes:

> io_ring_buffers_peek() builds an iovec array from provided buffers, and
> that in turn can be handed off to a lower level provider. Be prudent and
> cap the total size to MAX_RW_COUNT, which is the Linux default for how
> much IO do to in a single call.
>
> No bugs here, but it's a good preventative measure to avoid truncation
> issues.
>
> Signed-off-by: Jens Axboe <axboe@kernel.dk>

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>

Re: [PATCH] io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT

[Nitesh Shetty]

[-- Attachment #1: Type: text/plain, Size: 474 bytes --]

On 26/07/26 04:28PM, Jens Axboe wrote:
>io_ring_buffers_peek() builds an iovec array from provided buffers, and
>that in turn can be handed off to a lower level provider. Be prudent and
>cap the total size to MAX_RW_COUNT, which is the Linux default for how
>much IO do to in a single call.
>
>No bugs here, but it's a good preventative measure to avoid truncation
>issues.
>
>Signed-off-by: Jens Axboe <axboe@kernel.dk>
>
Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]