diff options
| -rw-r--r-- | io_uring/memmap.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/io_uring/memmap.c b/io_uring/memmap.c index 3d71756bc598..ea08f19dc648 100644 --- a/io_uring/memmap.c +++ b/io_uring/memmap.c @@ -136,7 +136,12 @@ struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages) struct page **pages; int ret; - end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT; + if (check_add_overflow(uaddr, len, &end)) + return ERR_PTR(-EOVERFLOW); + if (check_add_overflow(end, PAGE_SIZE - 1, &end)) + return ERR_PTR(-EOVERFLOW); + + end = end >> PAGE_SHIFT; start = uaddr >> PAGE_SHIFT; nr_pages = end - start; if (WARN_ON_ONCE(!nr_pages)) |