diff options
| author | Bijan Mottahedeh <bijan.mottahedeh@oracle.com> | 2020-06-04 18:01:52 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-06-08 09:39:13 -0600 |
| commit | efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff (patch) | |
| tree | ac84da6ebf30f721ed9fd75a8765d127dc73eaa3 /fs/io_uring.c | |
| parent | dddb3e26f6d88c5344d28cb5ff9d3d6fa05c4f7a (diff) | |
| download | lwn-efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff.tar.gz lwn-efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff.zip | |
io_uring: validate the full range of provided buffers for access
Account for the number of provided buffers when validating the address
range.
Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 70f0f2f940fb..5431b182b6b0 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3183,7 +3183,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); - if (!access_ok(u64_to_user_ptr(p->addr), p->len)) + if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs))) return -EFAULT; p->bgid = READ_ONCE(sqe->buf_group); |