Re: [PATCH v4 11/14] io_uring/rsrc: extend buffer update

[Anuj Gupta/Anuj Gupta]

On 7/29/2026 2:59 AM, Pavel Begunkov wrote:
> @@ -882,8 +894,13 @@ static struct io_rsrc_node 
> *io_sqe_buffer_register(struct io_ring_ctx *ctx,
>       struct io_imu_folio_data data;
>       bool coalesced = false;
>   
> -     if (!uaddr) {
> -             if (size)
> +     if (desc->type >= __IO_REGBUF_TYPE_MAX)
> +             return ERR_PTR(-EINVAL);
> +     if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)))
> +             return ERR_PTR(-EINVAL);

desc->flags  isn't validated here, unlike __resv. nonzero flags should 
be rejected too?

> +
> +     if (desc->type == IO_REGBUF_TYPE_EMPTY) {
> +             if (uaddr || size)
>                       return ERR_PTR(-EFAULT);
>               /* remove the buffer without installing a new one */
>               return NULL;