diff options
| author | Takashi Iwai <tiwai@suse.de> | 2022-12-22 11:11:48 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2022-12-22 11:11:48 +0300 |
| commit | 2d78eb0342dd2c9c5cde9ae9ada1d33f189a858b (patch) | |
| tree | f711bc9cab45f4963e4883ef15ff4c54a6cbc12e /io_uring/kbuf.c | |
| parent | b47068b4aa53a57552398e3f60d0ed1918700c2b (diff) | |
| parent | ee0b089d660021792e4ab4dda191b097ce1e964f (diff) | |
| download | linux-2d78eb0342dd2c9c5cde9ae9ada1d33f189a858b.tar.xz | |
Merge branch 'for-next' into for-linus
Diffstat (limited to 'io_uring/kbuf.c')
| -rw-r--r-- | io_uring/kbuf.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 25cd724ade18..e2c46889d5fa 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -346,6 +346,8 @@ int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe tmp = READ_ONCE(sqe->off); if (tmp > USHRT_MAX) return -E2BIG; + if (tmp + p->nbufs >= USHRT_MAX) + return -EINVAL; p->bid = tmp; return 0; } |