From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kees Cook <keescook@chromium.org>,
Silvio Cesare <silvio.cesare@gmail.com>,
Richard Weinberger <richard@nod.at>
Subject: [PATCH 3.18 23/29] Revert "UBIFS: Fix potential integer overflow in allocation"
Date: Fri, 7 Sep 2018 23:10:44 +0200 [thread overview]
Message-ID: <20180907210911.087838848@linuxfoundation.org> (raw)
In-Reply-To: <20180907210909.523240901@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 08acbdd6fd736b90f8d725da5a0de4de2dd6de62 upstream.
This reverts commit 353748a359f1821ee934afc579cf04572406b420.
It bypassed the linux-mtd review process and fixes the issue not as it
should.
Cc: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/journal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1101,7 +1101,7 @@ static int recomp_data_node(struct ubifs
int err, len, compr_type, out_len;
out_len = le32_to_cpu(dn->size);
- buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
+ buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
if (!buf)
return -ENOMEM;
next prev parent reply other threads:[~2018-09-07 21:44 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-07 21:10 [PATCH 3.18 00/29] 3.18.122-stable review Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 01/29] spi: davinci: fix a NULL pointer dereference Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 02/29] powerpc/fadump: handle crash memory ranges array index overflow Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 03/29] powerpc/pseries: Fix endianness while restoring of r3 in MCE handler Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 04/29] 9p/virtio: fix off-by-one error in sg list bounds check Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 05/29] net/9p/client.c: version pointer uninitialized Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 06/29] net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree() Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 07/29] dm cache metadata: save in-core policy_hint_size to on-disk superblock Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 08/29] iio: ad9523: Fix displayed phase Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 09/29] iio: ad9523: Fix return value for ad952x_store() Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 10/29] tracing: Do not call start/stop() functions when tracing_on does not change Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 11/29] tracing/blktrace: Fix to allow setting same value Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 12/29] kthread, tracing: Dont expose half-written comm when creating kthreads Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 13/29] uprobes: Use synchronize_rcu() not synchronize_sched() Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 14/29] 9p: fix multiple NULL-pointer-dereferences Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 15/29] pnfs/blocklayout: off by one in bl_map_stripe() Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 16/29] ARM: tegra: Fix Tegra30 Cardhu PCA954x reset Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 17/29] mm/tlb: Remove tlb_remove_table() non-concurrent condition Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 18/29] osf_getdomainname(): use copy_to_user() Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 19/29] sys: dont hold uts_sem while accessing userspace memory Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 20/29] userns; Correct the comment in map_write Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 21/29] userns: move user access out of the mutex Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 22/29] ubifs: Fix memory leak in lprobs self-check Greg Kroah-Hartman
2018-09-07 21:10 ` Greg Kroah-Hartman [this message]
2018-09-07 21:10 ` [PATCH 3.18 24/29] ubifs: Fix synced_i_size calculation for xattr inodes Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 25/29] pwm: tiehrpwm: Fix disabling of output of PWMs Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 26/29] fb: fix lost console when the user unplugs a USB adapter Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 27/29] udlfb: set optimal write delay Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 28/29] getxattr: use correct xattr length Greg Kroah-Hartman
2018-09-07 21:10 ` [PATCH 3.18 29/29] bcache: release dc->writeback_lock properly in bch_writeback_thread() Greg Kroah-Hartman
2018-09-07 22:41 ` [PATCH 3.18 00/29] 3.18.122-stable review Nathan Chancellor
2018-09-08 5:23 ` Harsh 'Shandilya
2018-09-08 8:29 ` Greg Kroah-Hartman
2018-09-08 14:01 ` Guenter Roeck
2018-09-08 21:12 ` Guenter Roeck
2018-09-09 9:28 ` Greg Kroah-Hartman
2018-09-09 15:51 ` Guenter Roeck
2018-09-10 15:00 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180907210911.087838848@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=richard@nod.at \
--cc=silvio.cesare@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox