Commit 80834312 authored by Xi Wang's avatar Xi Wang Committed by Alex Elder
Browse files

ceph: fix overflow check in build_snap_context() 



The overflow check for a + n * b should be (n > (ULONG_MAX - a) / b),
rather than (n > ULONG_MAX / b - a).

Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Signed-off-by: default avatarSage Weil <sage@newdream.net>
parent 64486697

fs/ceph/snap.c

+1 −1
Original line number Diff line number Diff line
@@ -331,7 +331,7 @@ static int build_snap_context(struct ceph_snap_realm *realm) 


	/* alloc new snap context */

	err = -ENOMEM;

	if (num > ULONG_MAX / sizeof(u64) - sizeof(*snapc))

	if (num > (ULONG_MAX - sizeof(*snapc)) / sizeof(u64))

		goto fail;

	snapc = kzalloc(sizeof(*snapc) + num*sizeof(u64), GFP_NOFS);

	if (!snapc)