summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRichard Weinberger <richard@nod.at>2018-07-01 23:20:50 +0200
committerRichard Weinberger <richard@nod.at>2018-08-15 00:25:20 +0200
commit08acbdd6fd736b90f8d725da5a0de4de2dd6de62 (patch)
treee75dbf01113fb74f4c88793924f8e720ccb037d7
parent49d2e05fb474718804cd3d1ec1e07213ecffc040 (diff)
Revert "UBIFS: Fix potential integer overflow in allocation"
This reverts commit 353748a359f1821ee934afc579cf04572406b420. It bypassed the linux-mtd review process and fixes the issue not as it should. Cc: Kees Cook <keescook@chromium.org> Cc: Silvio Cesare <silvio.cesare@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger <richard@nod.at>
-rw-r--r--fs/ubifs/journal.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index c5d9c6136057..1406765c3ef9 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1288,11 +1288,10 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
int *new_len)
{
void *buf;
- int err, compr_type;
- u32 dlen, out_len, old_dlen;
+ int err, dlen, compr_type, out_len, old_dlen;
out_len = le32_to_cpu(dn->size);
- buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
+ buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
if (!buf)
return -ENOMEM;