From e8e86b7e6369ffbc2e9ee074385a942b2bb56c5f Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 2 Jun 2022 01:48:25 +0000 Subject: [PATCH] NFSD: prevent integer overflow on 32 bit systems stable inclusion from stable-4.19.238 commit 3a2789e8ccb4a3e2a631f6817a2d3bb98b8c4fd8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5A6BA CVE: NA -------------------------------- commit 23a9dbbe0faf124fc4c139615633b9d12a3a89ef upstream. On a 32 bit system, the "len * sizeof(*p)" operation can have an integer overflow. Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yongqiang Liu --- include/linux/sunrpc/xdr.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h index 33580cc72a43..8e3d35189bf8 100644 --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -509,6 +509,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr, if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) return -EBADMSG; + if (len > SIZE_MAX / sizeof(*p)) + return -EBADMSG; p = xdr_inline_decode(xdr, len * sizeof(*p)); if (unlikely(!p)) return -EBADMSG; -- GitLab