diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2012-03-19 17:02:01 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2012-03-19 17:02:01 -0700 |
| commit | 10ce3cc919f50c2043b41ca968b43c26a3672600 (patch) | |
| tree | ea409366a5208aced495bc0516a08b81fd43222e /fs/nfs/callback_xdr.c | |
| parent | 24e3e5ae1e4c2a3a32f5b1f96b4e3fd721806acd (diff) | |
| parent | 5c6a7a62c130afef3d61c1dee153012231ff5cd9 (diff) | |
Merge branch 'next' into for-linus
Diffstat (limited to 'fs/nfs/callback_xdr.c')
| -rw-r--r-- | fs/nfs/callback_xdr.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 726e59a9e50..d50b2742f23 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -305,6 +305,10 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, n = ntohl(*p++); if (n <= 0) goto out; + if (n > ULONG_MAX / sizeof(*args->devs)) { + status = htonl(NFS4ERR_BADXDR); + goto out; + } args->devs = kmalloc(n * sizeof(*args->devs), GFP_KERNEL); if (!args->devs) { |