diff options
| author |   Xi Wang <xi.wang@gmail.com> | 2012-04-20 15:49:44 -0500 |
|---|---|---|
| committer |   Alex Elder <elder@dreamhost.com> | 2012-05-14 12:12:41 -0500 |
| commit | 50f7c4c967d0b5acd8e7ba6ab654dc4a7ac869ac (patch) | |
| tree | a37aa5a2aad9e434bf6b77e0b65601b6e30589b2 /include/linux/timerqueue.h | |
| parent | rbd: use gfp_flags parameter in rbd_header_from_disk() (diff) | |
rbd: fix integer overflow in rbd_header_from_disk()
ondisk->snap_count is read from disk via rbd_req_sync_read() and thus
needs validation. Otherwise, a bogus `snap_count' could overflow the
kmalloc() size, leading to memory corruption.
Also use `u32' consistently for `snap_count'.
[elder@dreamhost.com: changed to use UINT_MAX rather than ULONG_MAX]
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions