Re: [PATCH] io_uring/query: cap user size passed to copy_struct_to_user

[Jens Axboe]

On Fri, 21 Aug 2026 16:18:17 +0545, Laxman Acharya wrote:
> io_handle_query_entry() clamps hdr.size for the inbound copy_from_user()
> but keeps the original user value as usize. copy_struct_to_user() uses
> that usize and, when it is larger than the kernel result, clear_user()s
> the trailing bytes.
> 
> As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing,
> including on the error path where res_size stays 0. The interface is
> reachable without a ring via IORING_REGISTER_QUERY.
> 
> [...]

Applied, thanks!

[1/1] io_uring/query: cap user size passed to copy_struct_to_user
      commit: ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b

Best regards,
-- 
Jens Axboe