Skip to content

Commit c5f31c6

Browse files
Zheng Yejianakpm00
Zheng Yejian
authored andcommitted
acct: fix potential integer overflow in encode_comp_t()
The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Zheng Yejian <[email protected]> Cc: Hanjun Guo <[email protected]> Cc: Randy Dunlap <[email protected]> Cc: Vlastimil Babka <[email protected]> Cc: Zhang Jinhao <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
1 parent 457139f commit c5f31c6

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

kernel/acct.c

+2
Original file line numberDiff line numberDiff line change
@@ -350,6 +350,8 @@ static comp_t encode_comp_t(u64 value)
350350
exp++;
351351
}
352352

353+
if (exp > (((comp_t) ~0U) >> MANTSIZE))
354+
return (comp_t) ~0U;
353355
/*
354356
* Clean it up and polish it off.
355357
*/

0 commit comments

Comments
 (0)