From efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff Mon Sep 17 00:00:00 2001 From: Bijan Mottahedeh <bijan.mottahedeh@oracle.com> Date: Thu, 4 Jun 2020 18:01:52 -0700 Subject: [PATCH] io_uring: validate the full range of provided buffers for access Account for the number of provided buffers when validating the address range. Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> --- fs/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 70f0f2f940fbd5..5431b182b6b005 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3183,7 +3183,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); - if (!access_ok(u64_to_user_ptr(p->addr), p->len)) + if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs))) return -EFAULT; p->bgid = READ_ONCE(sqe->buf_group); -- GitLab