summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSilvio Cesare <silvio.cesare@gmail.com>2018-05-04 13:44:02 +1000
committerKees Cook <keescook@chromium.org>2018-06-12 16:19:22 -0700
commit353748a359f1821ee934afc579cf04572406b420 (patch)
treec386b02a98fa6658d42dce10ce588f99536ea339
parentf3278e3f0ac42d07902d9a29d259eab7e108108a (diff)
downloadlinux-353748a359f1821ee934afc579cf04572406b420.tar.bz2
UBIFS: Fix potential integer overflow in allocation
There is potential for the size and len fields in ubifs_data_node to be too large causing either a negative value for the length fields or an integer overflow leading to an incorrect memory allocation. Likewise, when the len field is small, an integer underflow may occur. Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com> Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
-rw-r--r--fs/ubifs/journal.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index da8afdfccaa6..07b4956e0425 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1282,10 +1282,11 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
int *new_len)
{
void *buf;
- int err, dlen, compr_type, out_len, old_dlen;
+ int err, compr_type;
+ u32 dlen, out_len, old_dlen;
out_len = le32_to_cpu(dn->size);
- buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+ buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
if (!buf)
return -ENOMEM;