| Message ID | 20120927204908.GA13222@elgon.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Sep 27, 2012 at 11:49:08PM +0300, Dan Carpenter wrote: > I tried to fix this before by adding the ULONG_MAX check, but num_aces > is an unsigned int so it should have been UINT_MAX. Sorry for that. > These days we can just call kmalloc_array() which has the overflow check > built in. > Uh... It turns out that I still suck at understanding C. My first patch was fine. Sorry for the noise. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c index 2ee5c54..bc9fcfb 100644 --- a/fs/cifs/cifsacl.c +++ b/fs/cifs/cifsacl.c @@ -910,9 +910,7 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, umode_t group_mask = S_IRWXG; umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO; - if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *)) - return; - ppace = kmalloc(num_aces * sizeof(struct cifs_ace *), + ppace = kmalloc_array(num_aces, sizeof(struct cifs_ace *), GFP_KERNEL); if (!ppace) { cERROR(1, "DACL memory allocation error");
I tried to fix this before by adding the ULONG_MAX check, but num_aces is an unsigned int so it should have been UINT_MAX. Sorry for that. These days we can just call kmalloc_array() which has the overflow check built in. Reported-by: pipacs Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html