@@ -215,21 +215,19 @@ static int io_compat_msg_copy_hdr(struct io_kiocb *req,
uiov = compat_ptr(msg->msg_iov);
if (req->flags & REQ_F_BUFFER_SELECT) {
- compat_ssize_t clen;
-
if (msg->msg_iovlen == 0) {
sr->len = iov->iov_len = 0;
iov->iov_base = NULL;
} else if (msg->msg_iovlen > 1) {
return -EINVAL;
} else {
- if (!access_ok(uiov, sizeof(*uiov)))
- return -EFAULT;
- if (__get_user(clen, &uiov->iov_len))
+ struct compat_iovec tmp_iov;
+
+ if (copy_from_user(&tmp_iov, uiov, sizeof(tmp_iov)))
return -EFAULT;
- if (clen < 0)
+ if (tmp_iov.iov_len < 0)
return -EINVAL;
- sr->len = clen;
+ sr->len = tmp_iov.iov_len;
}
return 0;
Use copy_from_user() instead of open coded access_ok() + get_user(), that's simpler and we don't care about compat that much. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- io_uring/net.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)