NFSv4.1: integer overflow in decode_cb_sequence_args()

This seems like it could overflow on 32 bits.  Use kmalloc_array() which
has overflow protection built in.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 95bfc24..27c2969 100644 (file)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
        args->csa_nrclists = ntohl(*p++);
        args->csa_rclists = NULL;
        if (args->csa_nrclists) {
-               args->csa_rclists = kmalloc(args->csa_nrclists *
-                                           sizeof(*args->csa_rclists),
-                                           GFP_KERNEL);
+               args->csa_rclists = kmalloc_array(args->csa_nrclists,
+                                                 sizeof(*args->csa_rclists),
+                                                 GFP_KERNEL);
                if (unlikely(args->csa_rclists == NULL))
                        goto out;