From d4b159ae93b57be0e9f296b8f0030005175de774 Mon Sep 17 00:00:00 2001
From: Rahat Mahmood <rahat@google.com>
Date: Mon, 31 Oct 2022 22:32:10 -0700
Subject: [PATCH] iouring: Disallow zero, or less CQ entries than SQ entries

Reported-by: syzbot+ad039a9d567cc9ba5ea8@syzkaller.appspotmail.com
PiperOrigin-RevId: 485230763
---
 pkg/sentry/fsimpl/iouringfs/iouringfs.go |  5 +++--
 test/syscalls/linux/io_uring.cc          | 14 ++++++++++++++
 test/util/io_uring_util.h                |  1 +
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/pkg/sentry/fsimpl/iouringfs/iouringfs.go b/pkg/sentry/fsimpl/iouringfs/iouringfs.go
index 6125384f4..13a12d764 100644
--- a/pkg/sentry/fsimpl/iouringfs/iouringfs.go
+++ b/pkg/sentry/fsimpl/iouringfs/iouringfs.go
@@ -92,10 +92,11 @@ func New(ctx context.Context, vfsObj *vfs.VirtualFilesystem, entries uint32, par
 	}
 	var numCqEntries uint32
 	if params.Flags&linux.IORING_SETUP_CQSIZE != 0 {
-		if params.CqEntries > linux.IORING_MAX_CQ_ENTRIES {
+		var ok bool
+		numCqEntries, ok = roundUpPowerOfTwo(params.CqEntries)
+		if !ok || numCqEntries < numSqEntries || numCqEntries > linux.IORING_SETUP_CQSIZE {
 			return nil, linuxerr.EINVAL
 		}
-		numCqEntries = params.CqEntries
 	} else {
 		numCqEntries = 2 * numSqEntries
 	}
diff --git a/test/syscalls/linux/io_uring.cc b/test/syscalls/linux/io_uring.cc
index 0d9534cc5..ead75c9e0 100644
--- a/test/syscalls/linux/io_uring.cc
+++ b/test/syscalls/linux/io_uring.cc
@@ -52,6 +52,20 @@ TEST(IOUringTest, ParamsNonZeroResv) {
   ASSERT_THAT(IOUringSetup(1, &params), SyscallFailsWithErrno(EINVAL));
 }
 
+TEST(IOUringTest, ZeroCQEntries) {
+  IOUringParams params;
+  params.cq_entries = 0;
+  params.flags = IORING_SETUP_CQSIZE;
+  ASSERT_THAT(IOUringSetup(1, &params), SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(IOUringTest, ZeroCQEntriesLessThanSQEntries) {
+  IOUringParams params;
+  params.cq_entries = 16;
+  params.flags = IORING_SETUP_CQSIZE;
+  ASSERT_THAT(IOUringSetup(32, &params), SyscallFailsWithErrno(EINVAL));
+}
+
 // Testing that io_uring_setup(2) fails with EINVAL on unsupported flags.
 TEST(IOUringTest, UnsupportedFlags) {
   if (IsRunningOnGvisor()) {
diff --git a/test/util/io_uring_util.h b/test/util/io_uring_util.h
index 0b93badec..5dea5b340 100644
--- a/test/util/io_uring_util.h
+++ b/test/util/io_uring_util.h
@@ -34,6 +34,7 @@ namespace testing {
 
 // io_uring_setup(2) flags.
 #define IORING_SETUP_SQPOLL (1U << 1)
+#define IORING_SETUP_CQSIZE (1U << 3)
 
 #define IORING_FEAT_SINGLE_MMAP (1U << 0)