1 files changed, 8 insertions, 0 deletions

diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index b44bdb291b84..d22281d60071 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -57,6 +57,14 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
         if (argv->v_size > PAGE_SIZE)
                 return -EINVAL;
 
+        /*
+         * Reject pairs of a start item position (argv->v_index) and a
+         * total count (argv->v_nmembs) which leads position 'pos' to
+         * overflow by the increment at the end of the loop.
+         */
+        if (argv->v_index > ~(__u64)0 - argv->v_nmembs)
+                return -EINVAL;
+
         buf = (void *)__get_free_pages(GFP_NOFS, 0);
         if (unlikely(!buf))
                 return -ENOMEM;