Re: [patch 2/2] staging: lustre: integer overflow in obd_ioctl_is_invalid()

2014-04-25 Thread walter harms
Am 24.04.2014 23:49, schrieb Dan Carpenter: The obd_ioctl_getdata() function caps data-ioc_len at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid. There are several lengths inside data but when they are added together

Re: [patch 2/2] staging: lustre: integer overflow in obd_ioctl_is_invalid()

2014-04-25 Thread Dan Carpenter
On Fri, Apr 25, 2014 at 09:13:21AM +0200, walter harms wrote: Am 24.04.2014 23:49, schrieb Dan Carpenter: The obd_ioctl_getdata() function caps data-ioc_len at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid.

[patch 2/2] staging: lustre: integer overflow in obd_ioctl_is_invalid()

2014-04-24 Thread Dan Carpenter
The obd_ioctl_getdata() function caps data-ioc_len at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid. There are several lengths inside data but when they are added together they must not be larger than data-ioc_len. The checks

Re: [patch 2/2] staging: lustre: integer overflow in obd_ioctl_is_invalid()

2014-04-24 Thread Peng Tao
On Fri, Apr 25, 2014 at 5:49 AM, Dan Carpenter dan.carpen...@oracle.com wrote: The obd_ioctl_getdata() function caps data-ioc_len at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid. There are several lengths inside data but