1 files changed, 3 insertions, 0 deletions

diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 3e654273cfc2..ac258beeda3c 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                 if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
                         goto out_free;
 
+                if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
+                        goto out_free;
+
                 len = argv[n].v_size * argv[n].v_nmembs;
                 base = (void __user *)(unsigned long)argv[n].v_base;
                 if (len == 0) {