diff options
| author | John W. Linville <linville@tuxdriver.com> | 2012-02-15 16:24:37 -0500 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-02-15 16:24:37 -0500 |
| commit | ca994a36f585432458ead9133fcfe05440edbb7b (patch) | |
| tree | be05512153a9cd5cbe1f1234bc09fd9cd388ec58 /fs/nfs/callback_xdr.c | |
| parent | 12325280dfeba18164f9c47e226a40ab34e23ee7 (diff) | |
| parent | 2504a6423b9ab4c36df78227055995644de19edb (diff) | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
Conflicts:
net/mac80211/debugfs_sta.c
net/mac80211/sta_info.h
Diffstat (limited to 'fs/nfs/callback_xdr.c')
| -rw-r--r-- | fs/nfs/callback_xdr.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 726e59a9e50f..d50b2742f23b 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -305,6 +305,10 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, n = ntohl(*p++); if (n <= 0) goto out; + if (n > ULONG_MAX / sizeof(*args->devs)) { + status = htonl(NFS4ERR_BADXDR); + goto out; + } args->devs = kmalloc(n * sizeof(*args->devs), GFP_KERNEL); if (!args->devs) { |