From c38df4ce3a733548b138a2f37ad01fcf8b9b6009 Mon Sep 17 00:00:00 2001
From: Haogang Chen <haogangchen@gmail.com>
Date: Mon, 19 Dec 2011 17:11:56 -0800
Subject: [PATCH] --- yaml --- r: 276842 b: refs/heads/master c:
 481fe17e973fb97aa3edf17c69557afe88d8334f h: refs/heads/master v: v3

---
 [refs]                  | 2 +-
 trunk/fs/nilfs2/ioctl.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index a16f7c3ffd1f..5b6571e7060c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 695c60f21c69e525a89279a5f35bae4ff237afbc
+refs/heads/master: 481fe17e973fb97aa3edf17c69557afe88d8334f
diff --git a/trunk/fs/nilfs2/ioctl.c b/trunk/fs/nilfs2/ioctl.c
index 3e654273cfc2..ac258beeda3c 100644
--- a/trunk/fs/nilfs2/ioctl.c
+++ b/trunk/fs/nilfs2/ioctl.c
@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
 		if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
 			goto out_free;
 
+		if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
+			goto out_free;
+
 		len = argv[n].v_size * argv[n].v_nmembs;
 		base = (void __user *)(unsigned long)argv[n].v_base;
 		if (len == 0) {