]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 8a20237) | patch
SUNRPC: Fix integer overflow in decode_rc_list()
authorDan Carpenter <dan.carpenter@linaro.org>
Thu, 19 Sep 2024 08:50:33 +0000 (11:50 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Oct 2024 13:11:53 +0000 (15:11 +0200)
commit91b9a4c5cfca5dd337487ce9379ef299dd162664
tree35faa594f0f8f988a72e370d06569c57eba72834tree
parent8a2023730850f92a980d71919603eefd30b0ca06commit | diff
SUNRPC: Fix integer overflow in decode_rc_list()

[ Upstream commit 6dbf1f341b6b35bcc20ff95b6b315e509f6c5369 ]

The math in "rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t)" could have an
integer overflow.  Add bounds checking on rc_list->rcl_nrefcalls to fix
that.

Fixes: 4aece6a19cf7 ("nfs41: cb_sequence xdr implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nfs/callback_xdr.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git