From: Dan Carpenter Date: Mon, 28 Apr 2014 10:58:58 +0000 (+0300) Subject: staging: lustre: integer overflow in obd_ioctl_is_invalid() X-Git-Tag: omap-for-v3.16/fixes-against-rc1~39^2~36^2~1110 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ee02eb4ae43b3b65cbf4c49c6915fe9d63aac970;p=pandora-kernel.git staging: lustre: integer overflow in obd_ioctl_is_invalid() The obd_ioctl_getdata() function caps "data->ioc_len" at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid. There are several lengths inside data but when they are added together they must not be larger than "data->ioc_len". The checks against "(data->ioc_inllen1 > (1<<30))" are supposed to ensure that the addition does not have an integer overflow. But "(1<<30) * 4" actually can overflow 32 bits, so the checks are insufficient. I have changed it to "> OBD_MAX_IOCTL_BUFFER" instead. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed