diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:23:00 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-07 17:23:00 +0200 |
| commit | dcf5b8a7ae4e3875878529597c05f8cac4121515 (patch) | |
| tree | 0d86567a8feacb35b2a62c1ba6cf6c2fe3be65de /io_uring | |
| parent | 864c971e923f55d3ff5ac3ebc87aab8108d30c8a (diff) | |
| parent | 7cfc41f8e80f11ffa8382ed1a505154ceffb79c7 (diff) | |
| download | linux-rolling-lts.tar.gz linux-rolling-lts.zip | |
Merge v6.18.50linux-rolling-lts
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/query.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/io_uring/query.c b/io_uring/query.c index cf02893ba911..e0b42e07eb08 100644 --- a/io_uring/query.c +++ b/io_uring/query.c @@ -36,6 +36,9 @@ static int io_handle_query_entry(struct io_ring_ctx *ctx, if (copy_from_user(&hdr, uhdr, sizeof(hdr))) return -EFAULT; + /* copy_struct_to_user() zeros up to usize bytes */ + if (hdr.size > PAGE_SIZE) + return -E2BIG; usize = hdr.size; hdr.size = min(hdr.size, IO_MAX_QUERY_SIZE); udata = u64_to_user_ptr(hdr.query_data); |