]> git.baikalelectronics.ru Git - kernel.git/commit
xfs: Fix integer overflow in fs/xfs/linux-2.6/xfs_ioctl*.c
authorZhitong Wang <zhitong.wangzt@alibaba-inc.com>
Mon, 22 Mar 2010 22:51:22 +0000 (09:51 +1100)
committerAlex Elder <aelder@sgi.com>
Wed, 19 May 2010 14:58:07 +0000 (09:58 -0500)
commited8d96c499af339eb26fbaed1ace86bedacd4200
tree015ac765550296cac1bc9b3eee833d99630a83fa
parentc0a2e59e684cc5b4233a18f95bde7bf67f004e88
xfs: Fix integer overflow in fs/xfs/linux-2.6/xfs_ioctl*.c

The am_hreq.opcount field in the xfs_attrmulti_by_handle() interface
is not bounded correctly. The opcount is used to determine the size
of the buffer required. The size is bounded, but can overflow and so
the size checks may not be sufficient to catch invalid opcounts.
Fix it by catching opcount values that would cause overflows before
calculating the size.

Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com>
Reviewed-by: Dave Chinner <david@fromorbit.com>
fs/xfs/linux-2.6/xfs_ioctl.c
fs/xfs/linux-2.6/xfs_ioctl32.c