A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

NFSv4.1: integer overflow in decode_cb_sequence_args()

Browse source 
This seems like it could overflow on 32 bits.  Use kmalloc_array() which
has overflow protection built in.

Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
This commit is contained in:
Dan Carpenter 2012-06-12 10:37:08 +03:00 • committed by Trond Myklebust
commit 0439f31c35
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
fs/nfs/callback_xdr.c
View file

@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
args->csa_nrclists = ntohl(*p++);
args->csa_rclists = NULL;
if (args->csa_nrclists) {
args->csa_rclists = kmalloc(args->csa_nrclists *
sizeof(*args->csa_rclists),
GFP_KERNEL);
args->csa_rclists = kmalloc_array(args->csa_nrclists,
sizeof(*args->csa_rclists),
GFP_KERNEL);
if (unlikely(args->csa_rclists == NULL))
goto out;