diff options
| author | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2010-05-31 14:07:15 +0400 |
|---|---|---|
| committer | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2010-05-31 14:07:15 +0400 |
| commit | e37c83c06c2690157a989df40dc99a6b61c9ea15 (patch) | |
| tree | 024dfb8b2c9abeec9ca7cb0c0136c276d9aacc91 /fs/xfs/linux-2.6/xfs_ioctl.c | |
| parent | ce1f7d30766f6549db6fa0b9e595e0d26a5b7d9a (diff) | |
| parent | 67a3e12b05e055c0415c556a315a3d3eb637e29e (diff) | |
| download | linux-e37c83c06c2690157a989df40dc99a6b61c9ea15.tar.xz | |
Merge commit 'v2.6.35-rc1' into for-2.6.36
Diffstat (limited to 'fs/xfs/linux-2.6/xfs_ioctl.c')
| -rw-r--r-- | fs/xfs/linux-2.6/xfs_ioctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c index 4ea1ee18aded..699b60cbab9c 100644 --- a/fs/xfs/linux-2.6/xfs_ioctl.c +++ b/fs/xfs/linux-2.6/xfs_ioctl.c @@ -58,6 +58,7 @@ #include <linux/mount.h> #include <linux/namei.h> #include <linux/pagemap.h> +#include <linux/slab.h> #include <linux/exportfs.h> /* @@ -526,6 +527,10 @@ xfs_attrmulti_by_handle( if (copy_from_user(&am_hreq, arg, sizeof(xfs_fsop_attrmulti_handlereq_t))) return -XFS_ERROR(EFAULT); + /* overflow check */ + if (am_hreq.opcount >= INT_MAX / sizeof(xfs_attr_multiop_t)) + return -E2BIG; + dentry = xfs_handlereq_to_dentry(parfilp, &am_hreq.hreq); if (IS_ERR(dentry)) return PTR_ERR(dentry); |