2 files changed, 15 insertions, 2 deletions

diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
index 69444f266e2d..dbc6d1a3be1f 100644
--- a/arch/sparc64/kernel/sys_sparc32.c
+++ b/arch/sparc64/kernel/sys_sparc32.c
@@ -337,12 +337,17 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
 
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
+        compat_ino_t ino;
         int err;
 
         if (stat->size > MAX_NON_LFS || !old_valid_dev(stat->dev) ||
             !old_valid_dev(stat->rdev))
                 return -EOVERFLOW;
 
+        ino = stat->ino;
+        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+                return -EOVERFLOW;
+
         err  = put_user(old_encode_dev(stat->dev), &statbuf->st_dev);
         err |= put_user(stat->ino, &statbuf->st_ino);
         err |= put_user(stat->mode, &statbuf->st_mode);
diff --git a/arch/sparc64/kernel/sys_sunos32.c b/arch/sparc64/kernel/sys_sunos32.c
index 953296b73f3f..e414c8ef0225 100644
--- a/arch/sparc64/kernel/sys_sunos32.c
+++ b/arch/sparc64/kernel/sys_sunos32.c
@@ -280,16 +280,20 @@ static int sunos_filldir(void * __buf, const char * name, int namlen,
         struct sunos_dirent __user *dirent;
         struct sunos_dirent_callback * buf = (struct sunos_dirent_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         if (dirent)
                 put_user(offset, &dirent->d_off);
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))
@@ -363,14 +367,18 @@ static int sunos_filldirentry(void * __buf, const char * name, int namlen,
         struct sunos_direntry_callback * buf =
                 (struct sunos_direntry_callback *) __buf;
         int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 1);
+        u32 d_ino;
 
         buf->error = -EINVAL;   /* only used if we fail.. */
         if (reclen > buf->count)
                 return -EINVAL;
+        d_ino = ino;
+        if (sizeof(d_ino) < sizeof(ino) && d_ino != ino)
+                return -EOVERFLOW;
         dirent = buf->previous;
         dirent = buf->curr;
         buf->previous = dirent;
-        put_user(ino, &dirent->d_ino);
+        put_user(d_ino, &dirent->d_ino);
         put_user(namlen, &dirent->d_namlen);
         put_user(reclen, &dirent->d_reclen);
         if (copy_to_user(dirent->d_name, name, namlen))