diff options
| -rw-r--r-- | fs/btrfs/send.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 67f7c698ade3..26dace7b74c6 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -8072,10 +8072,10 @@ long btrfs_ioctl_send(struct inode *inode, struct btrfs_ioctl_send_args *arg) /* * Check that we don't overflow at later allocations, we request * clone_sources_count + 1 items, and compare to unsigned long inside - * access_ok. + * access_ok. Also set an upper limit for allocation size so this can't + * easily exhaust memory. Max number of clone sources is about 200K. */ - if (arg->clone_sources_count > - ULONG_MAX / sizeof(struct clone_root) - 1) { + if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) { ret = -EINVAL; goto out; } |