Xi Wang
50f7c4c967
rbd: fix integer overflow in rbd_header_from_disk() ...
ondisk->snap_count is read from disk via rbd_req_sync_read() and thus
needs validation. Otherwise, a bogus `snap_count' could overflow the
kmalloc() size, leading to memory corruption.
Also use `u32' consistently for `snap_count'.
[elder@dreamhost.com: changed to use UINT_MAX rather than ULONG_MAX]
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Alex Elder <elder@dreamhost.com>
2012-05-14 12:12:41 -05:00
2012-02-08 15:07:03 -08:00
2012-02-13 18:31:37 +01:00
2012-02-19 18:57:51 -05:00
2012-02-18 15:37:25 -08:00
2012-02-06 14:37:52 -05:00
2012-05-14 12:12:41 -05:00
2012-02-15 13:09:26 +02:00
2012-02-08 20:03:14 +01:00
2012-01-26 18:36:48 +00:00
2012-02-22 16:48:51 +11:00
2012-03-03 09:31:49 -08:00
2012-02-02 14:00:43 +05:30
2012-02-21 16:47:28 -08:00
2012-01-30 21:33:34 +01:00
2012-02-01 21:59:37 -07:00
2012-03-15 09:41:26 +00:00
2012-03-05 10:28:58 +01:00
2012-03-14 09:17:03 -07:00
2012-03-15 18:11:05 +01:00
2012-02-13 18:31:37 +01:00
2012-01-19 21:26:32 -05:00
2012-02-10 14:18:46 -08:00
2012-03-07 08:31:31 -08:00
2012-03-08 11:36:06 +01:00
2012-02-09 15:41:29 -05:00
2012-02-08 19:03:51 -08:00
2012-02-16 16:15:12 +11:00
2012-03-08 17:21:51 -08:00
2012-03-15 17:06:05 -07:00
2012-03-01 01:42:52 +01:00
2012-03-05 15:49:43 -08:00
2012-03-04 12:25:15 -05:00
2012-02-04 07:17:47 -08:00
2012-03-16 02:01:41 -07:00
2012-02-27 10:09:52 -06:00
2012-02-27 09:44:15 -06:00
2012-03-07 20:26:47 -08:00
2012-02-16 10:41:23 +08:00
2012-02-01 19:35:21 +01:00
2012-03-12 10:25:51 -04:00
2012-02-01 21:34:26 +04:00
2012-03-05 15:49:43 -08:00
2012-03-15 17:03:03 -07:00
2012-03-11 20:39:10 +00:00
2012-03-05 15:49:43 -08:00
2012-03-02 17:33:00 +01:00
2012-03-05 15:49:43 -08:00
2012-01-24 10:44:49 +09:00
2012-02-13 11:57:58 -07:00
2012-02-01 15:26:00 -05:00
2012-02-08 16:19:06 -08:00
2012-03-13 21:43:58 -07:00
2012-01-23 03:15:25 -05:00
2012-03-09 12:59:44 +09:00
2012-03-02 16:08:54 -08:00
2012-03-15 17:03:04 -07:00
2012-03-01 09:28:41 +10:30
2012-02-29 09:46:13 +01:00
2012-02-03 16:07:05 -05:00
50f7c4c967