On Mon, Jun 24, 2013 at 07:27:19PM +0300, Dan Carpenter wrote: > We've seen cases where people passed negative numbers to > posix_acl_alloc() and we fixed the caller. For example 093019cf1b "xfs: > fix acl count validation in xfs_acl_from_disk()". But there are other > places which might be affected like ext4_acl_from_disk() which checks > for negative but doesn't check an upper limit. > > Signed-off-by: Dan Carpenter <[email protected]> > > diff --git a/fs/posix_acl.c b/fs/posix_acl.c > index cea4623..cd7fd2f 100644 > --- a/fs/posix_acl.c > +++ b/fs/posix_acl.c > @@ -46,7 +46,12 @@ posix_acl_alloc(int count, gfp_t flags) > { > const size_t size = sizeof(struct posix_acl) + > count * sizeof(struct posix_acl_entry); > - struct posix_acl *acl = kmalloc(size, flags); > + struct posix_acl *acl; > + > + if (count < 0 || count > (SIZE_MAX - sizeof(struct posix_acl) / > + sizeof(struct posix_acl_entry)))
Gar. I completely screwed that up. Please ignore this. I will send a better patch in a couple days. I am sorry. regards, dan carpenter > + return NULL; > + acl = kmalloc(size, flags); > if (acl) > posix_acl_init(acl, count); > return acl; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
