diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-08-21 16:18:17 +0545 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-08-25 11:49:48 -0600 |
| commit | ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b (patch) | |
| tree | a140d6e70316c85759bd6ebbc3f31135fbd2fd84 | |
| parent | 66498c75b4f8017f62d720d9b59675bdf3abce91 (diff) | |
| download | linux-ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b.tar.gz linux-ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b.zip | |
io_uring/query: cap user size passed to copy_struct_to_user
io_handle_query_entry() clamps hdr.size for the inbound copy_from_user()
but keeps the original user value as usize. copy_struct_to_user() uses
that usize and, when it is larger than the kernel result, clear_user()s
the trailing bytes.
As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing,
including on the error path where res_size stays 0. The interface is
reachable without a ring via IORING_REGISTER_QUERY.
Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_*
interfaces.
Fixes: c265ae75f900 ("io_uring: introduce io_uring querying")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260821103317.91437-1-acharyalaxman8848@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/query.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/io_uring/query.c b/io_uring/query.c index 4321f0b94b4b..7bce2ec162c1 100644 --- a/io_uring/query.c +++ b/io_uring/query.c @@ -76,6 +76,9 @@ static int io_handle_query_entry(union io_query_data *data, void __user *uhdr, if (copy_from_user(&hdr, uhdr, sizeof(hdr))) return -EFAULT; + /* copy_struct_to_user() zeros up to usize bytes */ + if (hdr.size > PAGE_SIZE) + return -E2BIG; usize = hdr.size; hdr.size = min(hdr.size, IO_MAX_QUERY_SIZE); udata = u64_to_user_ptr(hdr.query_data); |