iouring: Disallow zero, or less CQ entries than SQ entries

Reported-by: syzbot+ad039a9d567cc9ba5ea8@syzkaller.appspotmail.com
PiperOrigin-RevId: 485230763

pkg/sentry/fsimpl/iouringfs/iouringfs.go

@@ -92,10 +92,11 @@ func New(ctx context.Context, vfsObj *vfs.VirtualFilesystem, entries uint32, par
 	}
 	var numCqEntries uint32
 	if params.Flags&linux.IORING_SETUP_CQSIZE != 0 {
-		if params.CqEntries > linux.IORING_MAX_CQ_ENTRIES {
+		var ok bool
+		numCqEntries, ok = roundUpPowerOfTwo(params.CqEntries)
+		if !ok || numCqEntries < numSqEntries || numCqEntries > linux.IORING_SETUP_CQSIZE {
 			return nil, linuxerr.EINVAL
 		}
-		numCqEntries = params.CqEntries
 	} else {
 		numCqEntries = 2 * numSqEntries
 	}

test/syscalls/linux/io_uring.cc

@@ -52,6 +52,20 @@ TEST(IOUringTest, ParamsNonZeroResv) {
   ASSERT_THAT(IOUringSetup(1, &params), SyscallFailsWithErrno(EINVAL));
 }
 
+TEST(IOUringTest, ZeroCQEntries) {
+  IOUringParams params;
+  params.cq_entries = 0;
+  params.flags = IORING_SETUP_CQSIZE;
+  ASSERT_THAT(IOUringSetup(1, &params), SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(IOUringTest, ZeroCQEntriesLessThanSQEntries) {
+  IOUringParams params;
+  params.cq_entries = 16;
+  params.flags = IORING_SETUP_CQSIZE;
+  ASSERT_THAT(IOUringSetup(32, &params), SyscallFailsWithErrno(EINVAL));
+}
+
 // Testing that io_uring_setup(2) fails with EINVAL on unsupported flags.
 TEST(IOUringTest, UnsupportedFlags) {
   if (IsRunningOnGvisor()) {

test/util/io_uring_util.h

@@ -34,6 +34,7 @@ namespace testing {
 
 // io_uring_setup(2) flags.
 #define IORING_SETUP_SQPOLL (1U << 1)
+#define IORING_SETUP_CQSIZE (1U << 3)
 
 #define IORING_FEAT_SINGLE_MMAP (1U << 0)