Message ID | 1367341465-5155-1-git-send-email-jbacik@fusionio.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index ff40f1c..7c8964b 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -4587,8 +4587,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) } if (!access_ok(VERIFY_READ, arg->clone_sources, - sizeof(*arg->clone_sources * - arg->clone_sources_count))) { + sizeof(*arg->clone_sources) * + arg->clone_sources_count)) { ret = -EFAULT; goto out; }
A user reported a bug where we do sizeof(*ptr * count) instead of sizeof(*ptr) * count. Fix this. Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com> --- fs/btrfs/send.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)