xfs: Fix integer overflow in fs/xfs/linux-2.6/xfs_ioctl*.c
The am_hreq.opcount field in the xfs_attrmulti_by_handle() interface is not bounded correctly. The opcount is used to determine the size of the buffer required. The size is bounded, but can overflow and so the size checks may not be sufficient to catch invalid opcounts. Fix it by catching opcount values that would cause overflows before calculating the size. Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Reviewed-by: Dave Chinner <david@fromorbit.com>
This commit is contained in:
Родитель
e40152ee1e
Коммит
fda168c245
|
@ -527,6 +527,10 @@ xfs_attrmulti_by_handle(
|
|||
if (copy_from_user(&am_hreq, arg, sizeof(xfs_fsop_attrmulti_handlereq_t)))
|
||||
return -XFS_ERROR(EFAULT);
|
||||
|
||||
/* overflow check */
|
||||
if (am_hreq.opcount >= INT_MAX / sizeof(xfs_attr_multiop_t))
|
||||
return -E2BIG;
|
||||
|
||||
dentry = xfs_handlereq_to_dentry(parfilp, &am_hreq.hreq);
|
||||
if (IS_ERR(dentry))
|
||||
return PTR_ERR(dentry);
|
||||
|
|
|
@ -420,6 +420,10 @@ xfs_compat_attrmulti_by_handle(
|
|||
sizeof(compat_xfs_fsop_attrmulti_handlereq_t)))
|
||||
return -XFS_ERROR(EFAULT);
|
||||
|
||||
/* overflow check */
|
||||
if (am_hreq.opcount >= INT_MAX / sizeof(compat_xfs_attr_multiop_t))
|
||||
return -E2BIG;
|
||||
|
||||
dentry = xfs_compat_handlereq_to_dentry(parfilp, &am_hreq.hreq);
|
||||
if (IS_ERR(dentry))
|
||||
return PTR_ERR(dentry);
|
||||
|
|
Загрузка…
Ссылка в новой задаче