io_submit_sqes() shouldn't be stepping into its main loop when there is nothing to submit, i.e. nr=0. Fix 0 submission queue entries checks, which should follow after all user input truncations. Cc: stable@vger.kernel.org Fixes: 6962980947e2b ("io_uring: restructure submit sqes to_submit checks") Signed-off-by: Pavel Begunkov --- v2: split out of the series with extra tags, no functional changes io_uring/io_uring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 820ef0527666..ee04ab9bf968 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2422,10 +2422,11 @@ int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr) unsigned int left; int ret; + entries = min(nr, entries); if (unlikely(!entries)) return 0; - /* make sure SQ entry isn't read before tail */ - ret = left = min(nr, entries); + + ret = left = entries; io_get_task_refs(left); io_submit_state_start(&ctx->submit_state, left); -- 2.49.0