[PATCH 1/1] io_uring/zcrx: disallow user selected dmabuf offset and size

[PATCH 1/1] io_uring/zcrx: disallow user selected dmabuf offset and size

[Pavel Begunkov]

zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking
a subrange into it, the dmabuf layer might be not expecting that. It
shouldn't be a problem for now, but since the zcrx dmabuf support is new
and there shouldn't be any real users, let's play safe and reject user
provided ranges into dmabufs. Also, it shouldn't be needed as userspace
should size them appropriately.

Fixes: a5c98e9424573 ("io_uring/zcrx: dmabuf backed zerocopy receive")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 67c518d22e0c..e3eef4ee4454 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -76,6 +76,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
 	int dmabuf_fd = area_reg->dmabuf_fd;
 	int i, ret;
 
+	if (off)
+		return -EINVAL;
 	if (WARN_ON_ONCE(!ifq->dev))
 		return -EFAULT;
 	if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
@@ -106,7 +108,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq,
 	for_each_sgtable_dma_sg(mem->sgt, sg, i)
 		total_size += sg_dma_len(sg);
 
-	if (total_size < off + len) {
+	if (total_size != len) {
 		ret = -EINVAL;
 		goto err;
 	}
-- 
2.49.0

Re: [PATCH 1/1] io_uring/zcrx: disallow user selected dmabuf offset and size

[Jens Axboe]

On Mon, 14 Jul 2025 11:57:23 +0100, Pavel Begunkov wrote:
> zcrx shouldn't be so frivolous about cutting a dmabuf sgtable and taking
> a subrange into it, the dmabuf layer might be not expecting that. It
> shouldn't be a problem for now, but since the zcrx dmabuf support is new
> and there shouldn't be any real users, let's play safe and reject user
> provided ranges into dmabufs. Also, it shouldn't be needed as userspace
> should size them appropriately.
> 
> [...]

Applied, thanks!

[1/1] io_uring/zcrx: disallow user selected dmabuf offset and size
      commit: 08ca1409c4fa37ec93de08b9963390ed68a5ae8c

Best regards,
-- 
Jens Axboe