io_uring: fix index calculation

When indexing into a provided buffer ring, do not subtract 1 from the index. Fixes: c7fb194 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Dylan Yudaken <[email protected]> Link: https://lore.kernel.org/r/[email protected] Reviewed-by: Hao Xu <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
amarioguy · Jun 13, 2022 · 97da4a5 · 97da4a5
1 parent b13bacc
commit 97da4a5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/fs/io_uring.c b/fs/io_uring.c
@@ -3888,7 +3888,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,
 		buf = &br->bufs[head];
 	} else {
 		int off = head & (IO_BUFFER_LIST_BUF_PER_PAGE - 1);
-		int index = head / IO_BUFFER_LIST_BUF_PER_PAGE - 1;
+		int index = head / IO_BUFFER_LIST_BUF_PER_PAGE;
 		buf = page_address(bl->buf_pages[index]);
 		buf += off;
 	}