diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 0f9dcde72ebffae5b96221cd10369b0b9eb9711c..7ca3d2d2290eec97d7ff4830e12c9d3f8e17327d 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -879,7 +879,12 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages)
 	struct page **pages = NULL;
 	int pret, ret = -ENOMEM;
 
-	end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	if (check_add_overflow(ubuf, len, &end))
+		return ERR_PTR(-EOVERFLOW);
+	if (check_add_overflow(end, PAGE_SIZE - 1, &end))
+		return ERR_PTR(-EOVERFLOW);
+
+	end = end >> PAGE_SHIFT;
 	start = ubuf >> PAGE_SHIFT;
 	nr_pages = end - start;