Re: Re: [PATCH] net: datagram: fix integer overflow in zerocopy_sg_from_iter

[Jiangshan Yi]

Hi Joe,

Thanks for the review, you're right on all points.

I verified that import_ubuf(), __import_iovec(), and import_single_range()
all cap at MAX_RW_COUNT (INT_MAX & PAGE_MASK), which is below INT_MAX.
Both callers of zerocopy_sg_from_iter() (tun.c and tap.c) require
msg_control to be non-NULL for zerocopy, which means the socket sendmsg
path -- always through import_iovec. So the count is always capped, and
my "io_uring provided buffers" claim in the commit message was wrong.

You're also right about the type inconsistency -- leaving copy as int
defeats the purpose, and skb_copy_datagram_from_iter()'s int len remains
a problem regardless.

I did look into io_import_fixed(), the only iov_iter init path without a
MAX_RW_COUNT cap (used by WRITE_FIXED, SEND_ZC with FIXED_BUF, and
URING_CMD). It can produce count > INT_MAX. But this is by design --
BVEC iterators reference pre-registered pinned pages for zero-copy, so
the cap for copy_from_user limits doesn't apply. I traced the consumer
paths (generic_perform_write, tcp_sendmsg, udp_sendmsg, TUN/TAP, block
layer, etc.) and they all handle large counts safely via their own size
limits or chunked processing.

I'll withdraw this patch. Thanks for pushing me to actually understand
the code rather than surface-level pattern matching.

Best,
Jiangshan