diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2016-12-17 08:02:35 -0900 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2017-01-18 21:41:28 -0900 |
| commit | 554f46241edf9a2c43af7fd5b7d54a70d91aac20 (patch) | |
| tree | a67e4f1317b026a821f972557667fe3047a6f167 | |
| parent | 9c82c100adc96eb194ba73bbcf72f976331e7e24 (diff) | |
bcache: fix an integer overflow in journal compaction code
| -rw-r--r-- | drivers/md/bcache/journal.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c index ab057cc1293d..4239844b6dec 100644 --- a/drivers/md/bcache/journal.c +++ b/drivers/md/bcache/journal.c @@ -1899,7 +1899,8 @@ static void journal_write_compact(struct jset *jset) i->btree_id == prev->btree_id && i->level == prev->level && JOURNAL_ENTRY_TYPE(i) == JOURNAL_ENTRY_TYPE(prev) && - JOURNAL_ENTRY_TYPE(i) == JOURNAL_ENTRY_BTREE_KEYS) { + JOURNAL_ENTRY_TYPE(i) == JOURNAL_ENTRY_BTREE_KEYS && + le16_to_cpu(prev->u64s) + u64s <= U16_MAX) { memmove_u64s_down(jset_keys_next(prev), i->_data, u64s); |