diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index c81a5ca47bd233aaf244e231dbd210ec65553324..a82a5dc845c6f6b64fd15c83923955652ad54966 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1317,6 +1317,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, unsigned int cmd, unsigned long arg) { struct nbd_config *config = nbd->config; + loff_t bytesize; switch (cmd) { case NBD_DISCONNECT: @@ -1339,6 +1340,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, div_s64(arg, config->blksize)); return 0; case NBD_SET_SIZE_BLOCKS: + if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize)) + return -EINVAL; nbd_size_set(nbd, config->blksize, arg); return 0; case NBD_SET_TIMEOUT: