Re: [PATCH for-next] io_uring/query: check for loops in in_query()

[Pavel Begunkov <asml.silence@gmail.com>]

On 9/11/25 01:13, Jens Axboe wrote:
> io_query() loops over query items that the application or liburing
> passes in. But it has no checking for a max number of items, or if a
> loop could be present. If someone were to do:
> 
>          struct io_uring_query_hdr hdr1, hdr2, hdr3;
> 
>          hdr3.next_entry = &hdr1;
>          hdr2.next_entry = &hdr3;
>          hdr1.next_entry = &hdr2;
> 
>          io_uring_register(fd, IORING_REGISTER_QUERY, &hdr1, 0);
> 
> then it'll happily loop forever and process hdr1 -> hdr2 -> hdr3 and
> then loop back to hdr1.
> 
> Add a max cap for these kinds of cases, which is arbitrarily set to
> 1024 as well. Since there's now a cap, it seems that it would be saner
> to have this interface return the number of items processed. Eg 0..N
> for success, and < 0 for an error. Then if someone does need to query
> more than the supported number of items, they can do so iteratively.

That worsens usability. The user would have to know / count how
many entries there was in the first place, retry, and do all
handling. It'll be better to:

if (nr > (1U << 20))
	return -ERANGE;
if (fatal_signal_pending())
	return -EINTR;
...
return 0;


1M should be high enough for future proofing and to protect from
mildly insane users (and would still be fast enough). I also had
cond_resched() in some version, but apparently it got lost as
well.

-- 
Pavel Begunkov