diff options
| -rw-r--r-- | io_uring/rsrc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index c592ceace97d..94a9db030e0e 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1177,6 +1177,8 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx return -EINVAL; if (check_add_overflow(arg->nr, arg->dst_off, &nbufs)) return -EOVERFLOW; + if (nbufs > IORING_MAX_REG_BUFFERS) + return -EINVAL; ret = io_rsrc_data_alloc(&data, max(nbufs, ctx->buf_table.nr)); if (ret) |