提交 0439f31c 编写于 作者: D Dan Carpenter 提交者: Trond Myklebust

NFSv4.1: integer overflow in decode_cb_sequence_args()

This seems like it could overflow on 32 bits.  Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
上级 92123e06
...@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, ...@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
args->csa_nrclists = ntohl(*p++); args->csa_nrclists = ntohl(*p++);
args->csa_rclists = NULL; args->csa_rclists = NULL;
if (args->csa_nrclists) { if (args->csa_nrclists) {
args->csa_rclists = kmalloc(args->csa_nrclists * args->csa_rclists = kmalloc_array(args->csa_nrclists,
sizeof(*args->csa_rclists), sizeof(*args->csa_rclists),
GFP_KERNEL); GFP_KERNEL);
if (unlikely(args->csa_rclists == NULL)) if (unlikely(args->csa_rclists == NULL))
goto out; goto out;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册