diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-03-17 21:51:20 +0100 |
---|---|---|
committer | David Sterba <dsterba@suse.com> | 2017-03-29 14:29:08 +0200 |
commit | 457ae7268b29c33dee1c0feb143a15f6029d177b (patch) | |
tree | a1ebc64a816a1da2a67e01d928582b41eb48a611 /lib | |
parent | btrfs: Change qgroup_meta_rsv to 64bit (diff) | |
download | linux-457ae7268b29c33dee1c0feb143a15f6029d177b.tar.xz linux-457ae7268b29c33dee1c0feb143a15f6029d177b.zip |
Btrfs: fix an integer overflow check
This isn't super serious because you need CAP_ADMIN to run this code.
I added this integer overflow check last year but apparently I am
rubbish at writing integer overflow checks... There are two issues.
First, access_ok() works on unsigned long type and not u64 so on 32 bit
systems the access_ok() could be checking a truncated size. The other
issue is that we should be using a stricter limit so we don't overflow
the kzalloc() setting ctx->clone_roots later in the function after the
access_ok():
alloc_size = sizeof(struct clone_root) * (arg->clone_sources_count + 1);
sctx->clone_roots = kzalloc(alloc_size, GFP_KERNEL | __GFP_NOWARN);
Fixes: f5ecec3ce21f ("btrfs: send: silence an integer overflow warning")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ added comment ]
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions