| Date | Tue, 29 Apr 2014 12:08:10 +0300 | From | Dan Carpenter <> | Subject | Re: [PATCH 18/47] staging/lustre/hsm: HSM requests not delivered |
| |
On Sun, Apr 27, 2014 at 01:06:42PM -0400, Oleg Drokin wrote: > diff --git a/drivers/staging/lustre/lustre/llite/dir.c b/drivers/staging/lustre/lustre/llite/dir.c > index 7fbc18e..c391b60 100644 > --- a/drivers/staging/lustre/lustre/llite/dir.c > +++ b/drivers/staging/lustre/lustre/llite/dir.c > @@ -1804,6 +1804,11 @@ out_rmdir: > /* Compute the whole struct size */ > totalsize = hur_len(hur);
hur_len() has an integer overflow bug.
> OBD_FREE_PTR(hur); > + > + /* Final size will be more than double totalsize */ > + if (totalsize >= MDS_MAXREQSIZE / 3) > + return -E2BIG;
"totalsize" is signed and this condition doesn't take negatives into consideration. Make totalsize unsigned.
> + > OBD_ALLOC_LARGE(hur, totalsize);
How do we know that "totalsize" is more than sizeof(*hur)? If we fixed the overflow bug then maybe this isn't a problem. I haven't looked.
> if (hur == NULL) > return -ENOMEM;
regards, dan carpenter
|