On Thu, Apr 25, 2024 at 11:24:34PM +0900, Jeongjun Park wrote: > Matthew Wilcox wrote: > > It should be checked earlier than this. There's this code in > > dbMount(). Why isn't this catching it? > > This vulnerability occurs because a very large value can be passed > to iagp->agstart. So that code doesn't prevent the vulnerability. In your earlier mail, you said the large value was found in db_agl2size. If the problem is in agstart then diRead() is the right place to check it.
