liburing: avoid signed overflow in buffer ring indexing - #1629
Open
SantanDon wants to merge 1 commit into
Open
Conversation
io_uring_buf_ring_add() adds the 16-bit ring tail to the signed buf_offset before applying the ring mask. With a high tail and a large positive offset, that addition can overflow signed int and invoke undefined behavior. The index is inherently modulo the ring size. Convert buf_offset to unsigned before the addition so the wrap is defined while preserving existing behavior for normal offsets. Fixes: c41c485 ("Change io_uring_buf_ring_add() to take ring and buffer offset")
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Avoid signed integer overflow in the public
io_uring_buf_ring_add()helper when a high 16-bit ring tail is combined with a large positivebuf_offset.Why
The helper computes the buffer slot with:
br->tailis 16-bit and is promoted to signedintfor the addition. Withbr->tail = UINT16_MAXandbuf_offset = INT_MAX, UBSan reports signed integer overflow before the ring mask is applied.The slot calculation is inherently modulo the ring size. Converting
buf_offsetto unsigned before the addition makes wraparound defined while preserving normal offsets and the existing masked index behavior.Verification
A focused UBSan harness using the current expression reports:
With the proposed expression, UBSan is clean for offsets 0, 1, 2, 3 and the boundary case
UINT16_MAX + INT_MAX; ordinary masked indices are unchanged.git diff --checkis clean.This is submitted as undefined-behavior hardening; I am not claiming an out-of-ring write or kernel exploit.