diff options
author | Alex Shi <alex.shi@linaro.org> | 2018-01-18 15:26:28 +0800 |
---|---|---|
committer | Alex Shi <alex.shi@linaro.org> | 2018-01-18 15:26:28 +0800 |
commit | 2ba51c6d36ee1b43c1f898c6c48ddf3d33e9ab30 (patch) | |
tree | ff3302dc45a91d7bfcaabd37bfa8fa391a954180 /fs/btrfs/send.c | |
parent | 28610abf4a574c33ca70e3d7b0e523fdede488d1 (diff) | |
parent | 90816cc1d4a1d23efe37b74866c6174dd5eab6b5 (diff) |
Merge remote-tracking branch 'rt-stable/v4.9-rt' into linux-linaro-lsk-v4.9-rtlsk-v4.9-18.02-rt
Conflicts:
arch/arm64/mm/init.c
Diffstat (limited to 'fs/btrfs/send.c')
-rw-r--r-- | fs/btrfs/send.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 77f9efc1f7aa..9a47b5598df7 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -6196,8 +6196,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) goto out; } + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside + * access_ok. + */ if (arg->clone_sources_count > - ULLONG_MAX / sizeof(*arg->clone_sources)) { + ULONG_MAX / sizeof(struct clone_root) - 1) { ret = -EINVAL; goto out; } |