diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-06-12 10:37:08 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-06-07 16:02:04 -0700 |
| commit | 42b607da2d04e91439ba58d263e90a70d0243388 (patch) | |
| tree | 2809197e8779426ce32f7e37f1d484726985b9d1 /fs | |
| parent | ca36e74e1b126d0e02987a23bbe0b59922f4c548 (diff) | |
NFSv4.1: integer overflow in decode_cb_sequence_args()
commit 0439f31c35d1da0b28988b308ea455e38e6a350d upstream.
This seems like it could overflow on 32 bits. Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/nfs/callback_xdr.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 95bfc243992c..27c2969a9d02 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, args->csa_nrclists = ntohl(*p++); args->csa_rclists = NULL; if (args->csa_nrclists) { - args->csa_rclists = kmalloc(args->csa_nrclists * - sizeof(*args->csa_rclists), - GFP_KERNEL); + args->csa_rclists = kmalloc_array(args->csa_nrclists, + sizeof(*args->csa_rclists), + GFP_KERNEL); if (unlikely(args->csa_rclists == NULL)) goto out; |