From: Bijan Mottahedeh Date: Fri, 5 Jun 2020 01:01:52 +0000 (-0700) Subject: io_uring: validate the full range of provided buffers for access X-Git-Tag: io_uring-5.8-2020-06-11~10 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=efe68c1ca8f49e8c06afd74b699411bfbb8ba1ff;p=linux-block.git io_uring: validate the full range of provided buffers for access Account for the number of provided buffers when validating the address range. Signed-off-by: Bijan Mottahedeh Signed-off-by: Jens Axboe --- diff --git a/fs/io_uring.c b/fs/io_uring.c index 70f0f2f940fb..5431b182b6b0 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3183,7 +3183,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req, p->addr = READ_ONCE(sqe->addr); p->len = READ_ONCE(sqe->len); - if (!access_ok(u64_to_user_ptr(p->addr), p->len)) + if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs))) return -EFAULT; p->bgid = READ_ONCE(sqe->buf_group);