Commit efe68c1c authored Jun 04, 2020 by Bijan Mottahedeh Committed by Jens Axboe Jun 08, 2020

io_uring: validate the full range of provided buffers for access



Account for the number of provided buffers when validating the address
range.

Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent dddb3e26

fs/io_uring.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3183,7 +3183,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
		p->addr = READ_ONCE(sqe->addr);
		p->len = READ_ONCE(sqe->len);

		if (!access_ok(u64_to_user_ptr(p->addr), p->len))
		if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs)))
		return -EFAULT;

		p->bgid = READ_ONCE(sqe->buf_group);

Admin message