diff options
| author | David S. Miller <davem@davemloft.net> | 2017-04-06 07:25:07 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-04-06 08:24:51 -0700 |
| commit | 6f14f443d3e773439fb9cc6f2685ba90d5d026c5 (patch) | |
| tree | d45c11bba3458a805c4ac766ac85ebcf3c00b1eb /fs/btrfs/send.c | |
| parent | faeeb317a5615076dff1ff44b51e862e6064dbd0 (diff) | |
| parent | ea6b1720ce25f92f7a17b2e0c2b653d20773d10a (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Mostly simple cases of overlapping changes (adding code nearby,
a function whose name changes, for example).
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'fs/btrfs/send.c')
| -rw-r--r-- | fs/btrfs/send.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 456c8901489b..a60d5bfb8a49 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) goto out; } + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside + * access_ok. + */ if (arg->clone_sources_count > - ULLONG_MAX / sizeof(*arg->clone_sources)) { + ULONG_MAX / sizeof(struct clone_root) - 1) { ret = -EINVAL; goto out; } |