lkml.org 
[lkml]   [2012]   [Feb]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] ceph: fix overflow check in build_snap_context()
    Date
    The overflow check for a + n * b should be (n > (ULONG_MAX - a) / b),
    rather than (n > ULONG_MAX / b - a).

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    ---
    fs/ceph/snap.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
    index a559c80..f04c096 100644
    --- a/fs/ceph/snap.c
    +++ b/fs/ceph/snap.c
    @@ -331,7 +331,7 @@ static int build_snap_context(struct ceph_snap_realm *realm)

    /* alloc new snap context */
    err = -ENOMEM;
    - if (num > ULONG_MAX / sizeof(u64) - sizeof(*snapc))
    + if (num > (ULONG_MAX - sizeof(*snapc)) / sizeof(u64))
    goto fail;
    snapc = kzalloc(sizeof(*snapc) + num*sizeof(u64), GFP_NOFS);
    if (!snapc)
    --
    1.7.5.4


    \
     
     \ /
      Last update: 2012-02-16 18:01    [W:3.673 / U:1.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site