--- fs/aio.c

+++ fs/aio.c

@@ -1639,6 +1639,9 @@ SYSCALL_DEFINE3(io_submit, aio_context_t

if (unlikely(nr < 0))

return -EINVAL;

+ if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))

+ nr = LONG_MAX/sizeof(*iocbpp);

+

if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))

return -EFAULT;