diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-10-27 19:09:28 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-10-27 19:19:13 -0600 |
| commit | 101e596e7404d07a85b38358a392009503aad797 (patch) | |
| tree | cba174794aa0a154ea056adb09ca6f301354010c /tools/lib/python/kdoc/python_version.py | |
| parent | 0ecf0e6748120842700efc5dbf22a18580f7efcf (diff) | |
io_uring/fdinfo: cap SQ iteration at max SQ entries
A previous commit changed the logic around how SQ entries are iterated,
and as a result, had a few bugs. One is that it fully trusts the SQ
head and tail, which are user exposed. Another is that it fails to
increment the SQ head if the SQ index is out of range.
Fix both of those up, reverting to the previous logic of how to
iterate SQ entries.
Link: https://lore.kernel.org/io-uring/68ffdf18.050a0220.3344a1.039e.GAE@google.com/
Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Reported-by: syzbot+10a9b495f54a17b607a6@syzkaller.appspotmail.com
Tested-by: syzbot+10a9b495f54a17b607a6@syzkaller.appspotmail.com
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions