hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/drivers/block/loop.c
....@@ -1029,12 +1029,12 @@
10291029 if (err)
10301030 return err;
10311031
1032
+ /* Avoid assigning overflow values */
1033
+ if (info->lo_offset > LLONG_MAX || info->lo_sizelimit > LLONG_MAX)
1034
+ return -EOVERFLOW;
1035
+
10321036 lo->lo_offset = info->lo_offset;
10331037 lo->lo_sizelimit = info->lo_sizelimit;
1034
-
1035
- /* loff_t vars have been assigned __u64 */
1036
- if (lo->lo_offset < 0 || lo->lo_sizelimit < 0)
1037
- return -EOVERFLOW;
10381038
10391039 memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE);
10401040 memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE);