diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 956e2c715eb4..3dacaa3ab118 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -879,7 +879,12 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages)
 	struct page **pages = NULL;
 	int ret;
 
-	end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	if (check_add_overflow(ubuf, len, &end))
+		return ERR_PTR(-EOVERFLOW);
+	if (check_add_overflow(end, PAGE_SIZE - 1, &end))
+		return ERR_PTR(-EOVERFLOW);
+
+	end = end >> PAGE_SHIFT;
 	start = ubuf >> PAGE_SHIFT;
 	nr_pages = end - start;
 	WARN_ON(!nr_pages);