|
@@ -5978,6 +5978,12 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
|
|
goto out;
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
+ if (arg->clone_sources_count >
|
|
|
|
+ ULLONG_MAX / sizeof(*arg->clone_sources)) {
|
|
|
|
+ ret = -EINVAL;
|
|
|
|
+ goto out;
|
|
|
|
+ }
|
|
|
|
+
|
|
if (!access_ok(VERIFY_READ, arg->clone_sources,
|
|
if (!access_ok(VERIFY_READ, arg->clone_sources,
|
|
sizeof(*arg->clone_sources) *
|
|
sizeof(*arg->clone_sources) *
|
|
arg->clone_sources_count)) {
|
|
arg->clone_sources_count)) {
|