From: Sébastien Dugué <sebastien.dugue@bull.net>

sys_io_submit() and compat_sys_io_submit() check for the number of requests
(nr) being positive, but the following access_ok() call uses nr * sizeof(ptr)
which can overlow to a negative number.

Just make sure that nr * sizeof(ptr) is positive in the first place.

Signed-off-by: Sébastien Dugué <sebastien.dugue@bull.net>
Cc: Bharata B Rao <bharata@in.ibm.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Suparna Bhattacharya <suparna@in.ibm.com>
Cc: Zach Brown <zach.brown@oracle.com>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Benjamin LaHaise <bcrl@linux.intel.com>
Cc: Jean Pierre Dion <jean-pierre.dion@bull.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 fs/aio.c    |    2 +-
 fs/compat.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff -puN fs/aio.c~fix-access_ok-checks fs/aio.c
--- a/fs/aio.c~fix-access_ok-checks
+++ a/fs/aio.c
@@ -1630,7 +1630,7 @@ asmlinkage long sys_io_submit(aio_contex
 	long ret = 0;
 	int i;
 
-	if (unlikely(nr < 0))
+	if (unlikely((nr*sizeof(*iocbpp)) < 0))
 		return -EINVAL;
 
 	if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
diff -puN fs/compat.c~fix-access_ok-checks fs/compat.c
--- a/fs/compat.c~fix-access_ok-checks
+++ a/fs/compat.c
@@ -651,7 +651,7 @@ compat_sys_io_submit(aio_context_t ctx_i
 	long ret = 0;
 	int i;
 
-	if (unlikely(nr < 0))
+	if (unlikely((nr * sizeof(u32)) < 0))
 		return -EINVAL;
 
 	if (unlikely(!access_ok(VERIFY_READ, iocb, (nr * sizeof(u32)))))
_