iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/btrfs: Integer overflow in btrfs_ioctl_resize()

Browse Source 
The local variable 'new_size' comes from userspace. If a large number
was passed, there would be an integer overflow in the following line:
	new_size = old_size + new_size;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
Wenliang Fan 2013-12-20 15:28:56 +08:00 committed by Chris Mason
parent c9ea7b24ce
commit eb8052e015
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/btrfs/ioctl.c
View File

@ -1474,6 +1474,10 @@ static noinline int btrfs_ioctl_resize(struct file *file,
} }
new_size = old_size - new_size; new_size = old_size - new_size;
} else if (mod > 0) { } else if (mod > 0) {
if (new_size > ULLONG_MAX - old_size) {
ret = -EINVAL;
goto out_free;
}
new_size = old_size + new_size; new_size = old_size + new_size;
} }