diff options
| author | Vitaly Osipov <vitaly.osipov@gmail.com> | 2014-04-27 01:08:21 +1000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-05-03 19:33:15 -0400 |
| commit | 7bc3dfa37ba6f6ea81c362eb1993bd20c0828eae (patch) | |
| tree | 4dc39efbfd6e6b6c5d6f3bcc5f62aa019fe4624c /drivers/staging/lustre | |
| parent | 37aa48368f2508defb1976be62e1ed6ca4dde683 (diff) | |
| download | blackbird-obmc-linux-7bc3dfa37ba6f6ea81c362eb1993bd20c0828eae.tar.gz blackbird-obmc-linux-7bc3dfa37ba6f6ea81c362eb1993bd20c0828eae.zip | |
staging: lustre: check for integer overflow
In ll_ioctl_fiemap(), a user-supplied value is used to calculate a
length of a buffer which is later allocated with user data.
Signed-off-by: Vitaly Osipov <vitaly.osipov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/lustre')
| -rw-r--r-- | drivers/staging/lustre/lustre/llite/file.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/staging/lustre/lustre/llite/file.c b/drivers/staging/lustre/lustre/llite/file.c index 562e33751197..d87f96d9e0fa 100644 --- a/drivers/staging/lustre/lustre/llite/file.c +++ b/drivers/staging/lustre/lustre/llite/file.c @@ -1829,6 +1829,10 @@ static int ll_ioctl_fiemap(struct inode *inode, unsigned long arg) if (get_user(extent_count, &((struct ll_user_fiemap __user *)arg)->fm_extent_count)) return -EFAULT; + + if (extent_count >= + (SIZE_MAX - sizeof(*fiemap_s)) / sizeof(struct ll_fiemap_extent)) + return -EINVAL; num_bytes = sizeof(*fiemap_s) + (extent_count * sizeof(struct ll_fiemap_extent)); |
