From 0fc5a589aff7f9e613ff94fd3dd0a6686ffcb706 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 26 Feb 2025 11:41:16 +0000 Subject: [PATCH] io_uring/net: simplify compat selbuf iov parsing Use copy_from_user() instead of open coded access_ok() + get_user(), that's simpler and we don't care about compat that much. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e51f9c323a3cd4ad7c8da656559bdf6237f052fb.1740569495.git.asml.silence@gmail.com [axboe: fold in bogus < 0 check for tmp_iov.iov_len] Signed-off-by: Jens Axboe --- io_uring/net.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/io_uring/net.c b/io_uring/net.c index c78edfd5085e..dc1569864799 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -215,21 +215,17 @@ static int io_compat_msg_copy_hdr(struct io_kiocb *req, uiov = compat_ptr(msg->msg_iov); if (req->flags & REQ_F_BUFFER_SELECT) { - compat_ssize_t clen; - if (msg->msg_iovlen == 0) { sr->len = iov->iov_len = 0; iov->iov_base = NULL; } else if (msg->msg_iovlen > 1) { return -EINVAL; } else { - if (!access_ok(uiov, sizeof(*uiov))) - return -EFAULT; - if (__get_user(clen, &uiov->iov_len)) + struct compat_iovec tmp_iov; + + if (copy_from_user(&tmp_iov, uiov, sizeof(tmp_iov))) return -EFAULT; - if (clen < 0) - return -EINVAL; - sr->len = clen; + sr->len = tmp_iov.iov_len; } return 0; -- 2.50.1