diff options
| -rw-r--r-- | io_uring/rsrc.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 8d0f2ee24e0c..98dccefd801b 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1653,8 +1653,12 @@ int io_import_reg_vec(int ddir, struct iov_iter *iter, if (sizeof(struct bio_vec) > sizeof(struct iovec)) { size_t bvec_bytes; - bvec_bytes = nr_segs * sizeof(struct bio_vec); - nr_segs = (bvec_bytes + sizeof(*iov) - 1) / sizeof(*iov); + if (check_mul_overflow((size_t)nr_segs, sizeof(struct bio_vec), + &bvec_bytes) || + check_add_overflow(bvec_bytes, sizeof(*iov) - 1, + &bvec_bytes)) + return -EOVERFLOW; + nr_segs = bvec_bytes / sizeof(*iov); nr_segs += nr_iovs; } |