diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2012-06-12 10:37:08 +0300 |
|---|---|---|
| committer |   Trond Myklebust <Trond.Myklebust@netapp.com> | 2012-06-12 09:54:36 -0400 |
| commit | 0439f31c35d1da0b28988b308ea455e38e6a350d (patch) | |
| tree | 3d59dd6250c47968f5d6e521d3442525146660a4 /fs/nfs/callback_xdr.c | |
| parent | rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer (diff) | |
| download | linux-dev-0439f31c35d1da0b28988b308ea455e38e6a350d.tar.xz linux-dev-0439f31c35d1da0b28988b308ea455e38e6a350d.zip | |
NFSv4.1: integer overflow in decode_cb_sequence_args()
This seems like it could overflow on 32 bits. Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs/nfs/callback_xdr.c')
| -rw-r--r-- | fs/nfs/callback_xdr.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 95bfc243992c..27c2969a9d02 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp, args->csa_nrclists = ntohl(*p++); args->csa_rclists = NULL; if (args->csa_nrclists) { - args->csa_rclists = kmalloc(args->csa_nrclists * - sizeof(*args->csa_rclists), - GFP_KERNEL); + args->csa_rclists = kmalloc_array(args->csa_nrclists, + sizeof(*args->csa_rclists), + GFP_KERNEL); if (unlikely(args->csa_rclists == NULL)) goto out; |