diff options
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/query.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/io_uring/query.c b/io_uring/query.c index cf02893ba911..e0b42e07eb08 100644 --- a/io_uring/query.c +++ b/io_uring/query.c @@ -36,6 +36,9 @@ static int io_handle_query_entry(struct io_ring_ctx *ctx, if (copy_from_user(&hdr, uhdr, sizeof(hdr))) return -EFAULT; + /* copy_struct_to_user() zeros up to usize bytes */ + if (hdr.size > PAGE_SIZE) + return -E2BIG; usize = hdr.size; hdr.size = min(hdr.size, IO_MAX_QUERY_SIZE); udata = u64_to_user_ptr(hdr.query_data); |