io_ring_buffers_peek() builds an iovec array from provided buffers, and
that in turn can be handed off to a lower level provider. Be prudent and
cap the total size to MAX_RW_COUNT, which is the Linux default for how
much IO do to in a single call.

No bugs here, but it's a good preventative measure to avoid truncation
issues.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bceaba..1cf5be62bb65 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 	if (unlikely(!nr_avail))
 		return -ENOBUFS;
 
+	/* MAX_RW_COUNT is the universal Linux per-call IO maximum */
+	arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
+
 	buf = io_ring_head_to_buf(br, head, bl->mask);
 	if (arg->max_len) {
 		u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
 	/* set it to max, if not set, so we can use it unconditionally */
 	if (!arg->max_len)
-		arg->max_len = INT_MAX;
+		arg->max_len = MAX_RW_COUNT;
 
 	req->buf_index = READ_ONCE(buf->bid);
 	do {

-- 
Jens Axboe