From b44341e39d856e4cc6ad8ed94ebffd440f39846c Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Thu, 22 Oct 2026 13:25:35 +0200 Subject: [PATCH] aio: avoid request count overflow in ioctx_alloc() ioctx_alloc() saves the 32-bit nr_events in max_reqs, then doubles nr_events before checking the ring-size bound. For nr_events=0x80000001, the doubled value wraps to 2, so the ring check passes and aio_setup_ring() builds a one-page/127-slot ring. The original 0x80000001 is still stored in ctx->max_reqs and charged to the global aio_nr quota. If an administrator has raised fs.aio-max-nr to at least 0x80000001, an unprivileged process can create that context and make later normal io_setup() calls fail with -EAGAIN until the wrapped context is destroyed. Check for too large number of requests before multiplying. Link: https://lore.kernel.org/all/20261022091748.3653127-1-teel4res@gmail.com Reported-by: Cheng Yongkang Signed-off-by: Jan Kara Link: https://patch.msgid.link/20261022112534.3513745-2-jack@suse.cz Signed-off-by: Christian Brauner (Amutable) --- fs/aio.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 893db6961ad3..bf002a9d2ad7 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -816,13 +816,12 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) * counters at a time, so make sure that isn't 0: */ nr_events = max(nr_events, num_possible_cpus() * 4); - nr_events *= 2; - /* Prevent overflows */ - if (nr_events > (0x10000000U / sizeof(struct io_event))) { + if (nr_events > (0x8000000U / sizeof(struct io_event))) { pr_debug("ENOMEM: nr_events too high\n"); return ERR_PTR(-EINVAL); } + nr_events *= 2; if (!nr_events || (unsigned long)max_reqs > aio_max_nr) return ERR_PTR(-EAGAIN);