Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] io_uring: silent 32-bit truncation of __u64 uaddr and size in io_sqe_buffer_register --
commit a910d9c1c59f845e8a642099135fc16862f3fe7d Author: Pavel Begunkov <[email protected]> io_uring/rsrc: extend buffer update We need to pass more information to buffer registration than we can fit into a single struct iovec. This patch allows users to optionally pass struct io_uring_regbuf_desc, introducing an extended registration format with a new flags field and types. > diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c > index da767b34eb553..83a7ad9f5bc78 100644 > --- a/io_uring/rsrc.c > +++ b/io_uring/rsrc.c [ ... ] > @@ -882,8 +894,13 @@ static struct io_rsrc_node > *io_sqe_buffer_register(struct io_ring_ctx *ctx, > struct io_imu_folio_data data; > bool coalesced = false; > > - if (!uaddr) { > - if (size) > + if (desc->type >= __IO_REGBUF_TYPE_MAX) > + return ERR_PTR(-EINVAL); > + if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)) || desc->flags) > + return ERR_PTR(-EINVAL); > + > + if (desc->type == IO_REGBUF_TYPE_EMPTY) { > + if (uaddr || size) [Severity: Medium] Does this code silently truncate 64-bit user input on 32-bit platforms? The new struct io_uring_regbuf_desc defines uaddr and size as __u64: struct io_uring_regbuf_desc { ... __u64 size; __u64 uaddr; }; At the start of io_sqe_buffer_register(), these fields are immediately cast to unsigned long and size_t: static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, struct io_uring_regbuf_desc *desc) { unsigned long uaddr = (unsigned long)desc->uaddr; size_t size = desc->size; On 32-bit platforms, this drops the upper 32 bits before any validation occurs. If userspace passes 0x100000000 alongside IO_REGBUF_TYPE_EMPTY, the truncated uaddr and size evaluate to 0. Would this allow an invalid 64-bit address to pass the emptiness check and incorrectly bypass the -EFAULT error path? > return ERR_PTR(-EFAULT); > /* remove the buffer without installing a new one */ > return NULL; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=10
