diff options
| author | Ingo Molnar <[email protected]> | 2017-04-03 14:36:32 +0000 |
|---|---|---|
| committer | Ingo Molnar <[email protected]> | 2017-04-03 14:36:32 +0000 |
| commit | 7f75540ff2ca84dbac26cf9deeb620cbf5646f5e (patch) | |
| tree | 1eb54748074d3a91f3dd70fb5d4b23bf713f0bd5 /fs/btrfs/send.c | |
| parent | x86/mm/numa: Remove numa_nodemask_from_meminfo() (diff) | |
| parent | Linux 4.11-rc5 (diff) | |
| download | kernel-7f75540ff2ca84dbac26cf9deeb620cbf5646f5e.tar.gz kernel-7f75540ff2ca84dbac26cf9deeb620cbf5646f5e.zip | |
Merge tag 'v4.11-rc5' into x86/mm, to refresh the branch
Signed-off-by: Ingo Molnar <[email protected]>
Diffstat (limited to 'fs/btrfs/send.c')
| -rw-r--r-- | fs/btrfs/send.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 456c8901489b..a60d5bfb8a49 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) goto out; } + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside + * access_ok. + */ if (arg->clone_sources_count > - ULLONG_MAX / sizeof(*arg->clone_sources)) { + ULONG_MAX / sizeof(struct clone_root) - 1) { ret = -EINVAL; goto out; } |