diff options
| author | Dave Airlie <airlied@redhat.com> | 2017-04-11 07:40:42 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2017-04-11 07:40:42 +1000 |
| commit | b769fefb68cd70385d68220ae341e5a10723fbc0 (patch) | |
| tree | a2881410c9dc5a3474619d155fac981cfbd4ee8f /fs/btrfs/send.c | |
| parent | 1420f63b8207e966f54caec26d08abdc2ff37193 (diff) | |
| parent | 39da7c509acff13fc8cb12ec1bb20337c988ed36 (diff) | |
| download | linux-b769fefb68cd70385d68220ae341e5a10723fbc0.tar.bz2 | |
Backmerge tag 'v4.11-rc6' into drm-next
Linux 4.11-rc6
drm-misc needs 4.11-rc5, may as well fix conflicts with rc6.
Diffstat (limited to 'fs/btrfs/send.c')
| -rw-r--r-- | fs/btrfs/send.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 456c8901489b..a60d5bfb8a49 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) goto out; } + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside + * access_ok. + */ if (arg->clone_sources_count > - ULLONG_MAX / sizeof(*arg->clone_sources)) { + ULONG_MAX / sizeof(struct clone_root) - 1) { ret = -EINVAL; goto out; } |