Jens Axboe 33503c083f io_uring/memmap: cast nr_pages to size_t before shifting ... If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue. Link: https://lore.kernel.org/all/6895b298.050a0220.7f033.0059.GAE@google.com/ Cc: stable@vger.kernel.org Reported-by: syzbot+23727438116feb13df15@syzkaller.appspotmail.com Fixes: 087f997870 ("io_uring/memmap: implement mmap for regions") Signed-off-by: Jens Axboe <axboe@kernel.dk>		2025-08-08 06:35:14 -06:00
..
advise.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
advise.h
alloc_cache.c	io_uring: add alloc_cache.c	2025-01-28 15:10:40 -07:00
alloc_cache.h	io_uring/net: convert to struct iou_vec	2025-03-07 13:41:08 -07:00
cancel.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
cancel.h	io_uring/cancel: add generic cancel helper	2025-02-17 05:34:45 -07:00
cmd_net.c	io_uring/netcmd: add tx timestamping cmd support	2025-06-23 09:00:12 -06:00
epoll.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
epoll.h	io_uring/epoll: add support for IORING_OP_EPOLL_WAIT	2025-02-20 07:59:56 -07:00
eventfd.c	io_uring/eventfd: open code io_eventfd_grab()	2025-04-24 08:33:54 -06:00
eventfd.h	io_uring/eventfd: dedup signalling helpers	2025-04-24 08:33:54 -06:00
fdinfo.c	io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()	2025-06-10 11:20:04 -06:00
fdinfo.h
filetable.c	io_uring: cache nodes and mapped buffers	2025-02-28 07:05:46 -07:00
filetable.h	io_uring/rsrc: pass 'struct io_ring_ctx' reference to rsrc helpers	2024-11-07 15:24:33 -07:00
fs.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
fs.h
futex.c	io_uring/futex: mark wait requests as inflight	2025-06-04 10:50:14 -06:00
futex.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
io-wq.c	io_uring: fix task leak issue in io_wq_create()	2025-06-15 12:58:39 -06:00
io-wq.h	io_uring/wq: avoid indirect do_work/free_work calls	2025-04-21 05:06:58 -06:00
io_uring.c	for-6.17/io_uring-20250728	2025-07-28 16:30:12 -07:00
io_uring.h	io_uring: deduplicate wakeup handling	2025-07-15 12:20:06 -06:00
kbuf.c	io_uring/kbuf: flag partial buffer mappings	2025-06-26 12:17:48 -06:00
kbuf.h	io_uring/kbuf: flag partial buffer mappings	2025-06-26 12:17:48 -06:00
Kconfig	io_uring: make zcrx depend on CONFIG_IO_URING	2025-03-31 07:07:44 -06:00
Makefile	io_uring/mock: add basic infra for test mock files	2025-07-02 08:10:26 -06:00
memmap.c	io_uring/memmap: cast nr_pages to size_t before shifting	2025-08-08 06:35:14 -06:00
memmap.h	io_uring: update parameter name in io_pin_pages function declaration	2025-05-09 07:58:22 -06:00
mock_file.c	io_uring/mock: add trivial poll handler	2025-07-02 08:10:26 -06:00
msg_ring.c	io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU	2025-07-08 11:08:31 -06:00
msg_ring.h	io_uring/msg_ring: Drop custom destructor	2024-12-27 10:08:21 -07:00
napi.c	net: use napi_id_valid helper	2025-02-17 16:43:04 -08:00
napi.h	io_uring/napi: add static napi tracking strategy	2024-11-06 13:55:38 -07:00
net.c	io_uring/net: Allow to do vectorized send	2025-07-30 08:23:04 -06:00
net.h	io_uring/net: convert to struct iou_vec	2025-03-07 13:41:08 -07:00
nop.c	io_uring/nop: add IORING_NOP_TW completion flag	2025-06-23 08:59:13 -06:00
nop.h
notif.c	io_uring: remove io_preinit_req()	2025-05-06 10:11:23 -06:00
notif.h	io_uring/notif: implement notification stacking	2024-04-22 19:31:18 -06:00
opdef.c	Merge branch 'io_uring-6.16' into for-6.17/io_uring	2025-07-06 16:42:23 -06:00
opdef.h	io_uring: add struct io_cold_def->sqe_copy() method	2025-06-23 08:59:13 -06:00
openclose.c	fs/pipe: set FMODE_NOWAIT in create_pipe_files()	2025-06-10 13:16:19 +02:00
openclose.h	io_uring: add support for IORING_OP_PIPE	2025-04-21 05:06:58 -06:00
poll.c	for-6.17/io_uring-20250728	2025-07-28 16:30:12 -07:00
poll.h	io_uring/poll: introduce io_arm_apoll()	2025-06-23 09:00:12 -06:00
refs.h	io_uring: always do atomic put from iowq	2025-04-03 08:31:57 -06:00
register.c	io_uring: consistently use rcu semantics with sqpoll thread	2025-06-12 08:17:09 -06:00
register.h	io_uring: temporarily disable registered waits	2024-11-15 09:58:34 -07:00
rsrc.c	io_uring: export io_[un]account_mem	2025-07-16 16:23:28 -06:00
rsrc.h	io_uring: export io_[un]account_mem	2025-07-16 16:23:28 -06:00
rw.c	io_uring/rw: cast rw->flags assignment to rwf_t	2025-07-07 16:46:30 -06:00
rw.h	io_uring/kbuf: pass bgid to io_buffer_select()	2025-04-21 05:06:58 -06:00
slist.h	io_uring: silence variable ‘prev’ set but not used warning	2023-03-09 10:10:58 -07:00
splice.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
splice.h	io_uring/splice: open code 2nd direct file assignment	2024-10-29 13:43:28 -06:00
sqpoll.c	io_uring/sqpoll: don't put task_struct on tctx setup failure	2025-06-17 06:43:18 -06:00
sqpoll.h	io_uring: consistently use rcu semantics with sqpoll thread	2025-06-12 08:17:09 -06:00
statx.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
statx.h
sync.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
sync.h
tctx.c	io_uring/wq: avoid indirect do_work/free_work calls	2025-04-21 05:06:58 -06:00
tctx.h
timeout.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
timeout.h	io_uring/timeout: don't export link t-out disarm helper	2025-05-06 10:11:23 -06:00
truncate.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
truncate.h	io_uring: add support for ftruncate	2024-02-09 09:04:39 -07:00
uring_cmd.c	io_uring/cmd: remove struct io_uring_cmd_data	2025-07-18 12:34:56 -06:00
uring_cmd.h	io_uring/cmd: remove struct io_uring_cmd_data	2025-07-18 12:34:56 -06:00
waitid.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
waitid.h	io_uring: move cancelations to be io_uring_task based	2024-11-06 13:55:38 -07:00
xattr.c	io_uring: finish IOU_OK -> IOU_COMPLETE transition	2025-05-21 08:41:16 -06:00
xattr.h
zcrx.c	for-6.17/io_uring-20250728	2025-07-28 16:30:12 -07:00
zcrx.h	io_uring/zcrx: account area memory	2025-07-16 16:23:28 -06:00