From: Pavel Begunkov <asml.silence@gmail.com>
Date: Thu, 16 Oct 2025 11:20:31 +0000 (+0100)
Subject: io_uring: check for user passing 0 nr_submit
X-Git-Url: https://gentwo.org/gitweb/?a=commitdiff_plain;h=dde92a5026d81df1a146e9c243d09b27d1bf04bf;p=linux%2F.git

io_uring: check for user passing 0 nr_submit

io_submit_sqes() shouldn't be stepping into its main loop when there is
nothing to submit, i.e. nr=0. Fix 0 submission queue entries checks,
which should follow after all user input truncations.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index be44d636fe1f..93a1cc2bf383 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2453,10 +2453,11 @@ int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
 	unsigned int left;
 	int ret;
 
+	entries = min(nr, entries);
 	if (unlikely(!entries))
 		return 0;
-	/* make sure SQ entry isn't read before tail */
-	ret = left = min(nr, entries);
+
+	ret = left = entries;
 	io_get_task_refs(left);
 	io_submit_state_start(&ctx->submit_state, left);