From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> commit 23a9dbbe0faf124fc4c139615633b9d12a3a89ef upstream. On a 32 bit system, the "len * sizeof(*p)" operation can have an integer overflow. Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- include/linux/sunrpc/xdr.h | 2 ++ 1 file changed, 2 insertions(+) --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -509,6 +509,8 @@ xdr_stream_decode_uint32_array(struct xd if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) return -EBADMSG; + if (len > SIZE_MAX / sizeof(*p)) + return -EBADMSG; p = xdr_inline_decode(xdr, len * sizeof(*p)); if (unlikely(!p)) return -EBADMSG; Patches currently in stable-queue which might be from dan.carpenter@xxxxxxxxxx are queue-4.19/nfsd-prevent-underflow-in-nfssvc_decode_writeargs.patch queue-4.19/nfsd-prevent-integer-overflow-on-32-bit-systems.patch