git.openpandora.org / pandora-kernel.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: c9ea7b2)
fs/btrfs: Integer overflow in btrfs_ioctl_resize()
authorWenliang Fan <fanwlexca@gmail.com>
Fri, 20 Dec 2013 07:28:56 +0000 (15:28 +0800)
committerChris Mason <clm@fb.com>
Tue, 28 Jan 2014 21:20:11 +0000 (13:20 -0800)
The local variable 'new_size' comes from userspace. If a large number
was passed, there would be an integer overflow in the following line:
new_size = old_size + new_size;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Chris Mason <clm@fb.com>
fs/btrfs/ioctl.c patch | blob | history

diff --cc fs/btrfs/ioctl.c
Simple merge
Pandora Kernel Repository