2 files changed, 8 insertions, 0 deletions

diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index 7b26cc2fd284..699b60cbab9c 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -527,6 +527,10 @@ xfs_attrmulti_by_handle(
         if (copy_from_user(&am_hreq, arg, sizeof(xfs_fsop_attrmulti_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
 
+        /* overflow check */
+        if (am_hreq.opcount >= INT_MAX / sizeof(xfs_attr_multiop_t))
+                return -E2BIG;
+
         dentry = xfs_handlereq_to_dentry(parfilp, &am_hreq.hreq);
         if (IS_ERR(dentry))
                 return PTR_ERR(dentry);
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index 593c05b4df8d..9287135e9bfc 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -420,6 +420,10 @@ xfs_compat_attrmulti_by_handle(
                            sizeof(compat_xfs_fsop_attrmulti_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
 
+        /* overflow check */
+        if (am_hreq.opcount >= INT_MAX / sizeof(compat_xfs_attr_multiop_t))
+                return -E2BIG;
+
         dentry = xfs_compat_handlereq_to_dentry(parfilp, &am_hreq.hreq);
         if (IS_ERR(dentry))
                 return PTR_ERR(dentry);