DF-0147 / fix.diff
diff --git a/sys/kern/vfs_quota.c b/sys/kern/vfs_quota.c --- a/sys/kern/vfs_quota.c +++ b/sys/kern/vfs_quota.c @@ -155,6 +155,10 @@ ufind.left_bits = (uid >> ACCT_CHUNK_BITS); gfind.left_bits = (gid >> ACCT_CHUNK_BITS); + /* Reject deltas that would wrap the unsigned byte counters. */ + if (delta < 0 && (uint64_t)(-delta) > mp->mnt_acct.ac_bytes) + return; + spin_lock(&mp->mnt_acct.ac_spin); mp->mnt_acct.ac_bytes += delta; |