Commit efe68c1c authored by Bijan Mottahedeh's avatar Bijan Mottahedeh Committed by Jens Axboe
Browse files

io_uring: validate the full range of provided buffers for access 



Account for the number of provided buffers when validating the address
range.

Signed-off-by: default avatarBijan Mottahedeh <bijan.mottahedeh@oracle.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent dddb3e26

fs/io_uring.c

+1 −1
Original line number Diff line number Diff line
@@ -3183,7 +3183,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req, 
	p->addr = READ_ONCE(sqe->addr);

	p->len = READ_ONCE(sqe->len);



	if (!access_ok(u64_to_user_ptr(p->addr), p->len))

	if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs)))

		return -EFAULT;



	p->bgid = READ_ONCE(sqe->buf_group);