]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: cd1ec2d) | patch
rbd: fix integer overflow in rbd_header_from_disk()
authorXi Wang <xi.wang@gmail.com>
Fri, 20 Apr 2012 20:49:44 +0000 (15:49 -0500)
committerAlex Elder <elder@dreamhost.com>
Mon, 14 May 2012 17:12:41 +0000 (12:12 -0500)
commita05051badd5fb096c34d6ef562644de50c01db66
treea37aa5a2aad9e434bf6b77e0b65601b6e30589b2tree | snapshot
parentcd1ec2df1518827f772ef5390c34a0978472d9b1commit | diff
rbd: fix integer overflow in rbd_header_from_disk()

ondisk->snap_count is read from disk via rbd_req_sync_read() and thus
needs validation.  Otherwise, a bogus `snap_count' could overflow the
kmalloc() size, leading to memory corruption.

Also use `u32' consistently for `snap_count'.

[elder@dreamhost.com: changed to use UINT_MAX rather than ULONG_MAX]

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
drivers/block/rbd.c diff | blob | history
Linux Kernel Source Tree.