* [patch 1/2] NFSv4.1: integer overflow in decode_cb_sequence_args()
@ 2012-06-12 7:37 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2012-06-12 7:37 UTC (permalink / raw)
To: Trond Myklebust; +Cc: linux-nfs, linux-kernel, Benny Halevy, kernel-janitors
This seems like it could overflow on 32 bits. Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 95bfc24..27c2969 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
args->csa_nrclists = ntohl(*p++);
args->csa_rclists = NULL;
if (args->csa_nrclists) {
- args->csa_rclists = kmalloc(args->csa_nrclists *
- sizeof(*args->csa_rclists),
- GFP_KERNEL);
+ args->csa_rclists = kmalloc_array(args->csa_nrclists,
+ sizeof(*args->csa_rclists),
+ GFP_KERNEL);
if (unlikely(args->csa_rclists == NULL))
goto out;
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2012-06-12 7:37 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-06-12 7:37 [patch 1/2] NFSv4.1: integer overflow in decode_cb_sequence_args() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).