diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-04-01 11:12:15 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-04-03 11:07:33 +0200 |
| commit | faec8ab42b4a0f119a1cfbceef0c14b7b61059cb (patch) | |
| tree | 094358040b82121f65946431db4a086f3f722632 /drivers/staging/lustre | |
| parent | b311ebac5babac7ce2b11e35a1462815580324b8 (diff) | |
| download | op-kernel-dev-faec8ab42b4a0f119a1cfbceef0c14b7b61059cb.zip op-kernel-dev-faec8ab42b4a0f119a1cfbceef0c14b7b61059cb.tar.gz | |
Staging: lustre: integer overflow in ioctl
hdr->ioc_len is a user controlled u32 so the addition can overflow,
especially on 32 bit systems.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/lustre')
| -rw-r--r-- | drivers/staging/lustre/lustre/libcfs/linux/linux-module.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c index a5effcd..e962f89 100644 --- a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c +++ b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c @@ -57,7 +57,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) return -EINVAL; } - if (hdr->ioc_len + buf >= end) { + if (hdr->ioc_len >= end - buf) { CERROR("PORTALS: user buffer exceeds kernel buffer\n"); return -EINVAL; } |
