diff options
| author | Jonathan Cameron <jic23@kernel.org> | 2026-06-02 15:24:19 +0100 |
|---|---|---|
| committer | Jonathan Cameron <jic23@kernel.org> | 2026-06-02 15:24:19 +0100 |
| commit | c82228f76aaa3f77eca3ac22670aa69dd0e59d40 (patch) | |
| tree | d04d0936d748104c004a69fe35fc63e0bd3cdfdd /io_uring/kbuf.c | |
| parent | 3f2d03ecf22b09da1d92ba06e1ba6e20d16060e9 (diff) | |
| parent | e43ffb69e0438cddd72aaa30898b4dc446f664f8 (diff) | |
| download | linux-next-c82228f76aaa3f77eca3ac22670aa69dd0e59d40.tar.gz linux-next-c82228f76aaa3f77eca3ac22670aa69dd0e59d40.zip | |
Merge tag 'v7.1-rc6' into work
Linux 7.1-rc6
Diffstat (limited to 'io_uring/kbuf.c')
| -rw-r--r-- | io_uring/kbuf.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 8da2ff798170..63061aa1cab9 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -47,7 +47,7 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len) this_len = min_t(u32, len, buf_len); buf_len -= this_len; /* Stop looping for invalid buffer length of 0 */ - if (buf_len || !this_len) { + if (buf_len > bl->min_left_sub_one || !this_len) { WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len); WRITE_ONCE(buf->len, buf_len); return false; @@ -637,6 +637,10 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) if (reg.ring_entries >= 65536) return -EINVAL; + /* minimum left byte count is a property of incremental buffers */ + if (!(reg.flags & IOU_PBUF_RING_INC) && reg.min_left) + return -EINVAL; + bl = io_buffer_get_list(ctx, reg.bgid); if (bl) { /* if mapped buffer ring OR classic exists, don't allow */ @@ -680,10 +684,11 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) } #endif - bl->nr_entries = reg.ring_entries; bl->mask = reg.ring_entries - 1; bl->flags |= IOBL_BUF_RING; bl->buf_ring = br; + if (reg.min_left) + bl->min_left_sub_one = reg.min_left - 1; if (reg.flags & IOU_PBUF_RING_INC) bl->flags |= IOBL_INC; ret = io_buffer_add_list(ctx, bl, reg.bgid); |