Commit 0a280962dc6e117e0e4baa668453f753579265d9
1 parent
7e0e953bb0
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for allocation
X-Coverup: just ask spender Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Showing 1 changed file with 6 additions and 2 deletions Side-by-side Diff
fs/autofs4/dev-ioctl.c
| ... | ... | @@ -95,7 +95,7 @@ |
| 95 | 95 | */ |
| 96 | 96 | static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) |
| 97 | 97 | { |
| 98 | - struct autofs_dev_ioctl tmp; | |
| 98 | + struct autofs_dev_ioctl tmp, *res; | |
| 99 | 99 | |
| 100 | 100 | if (copy_from_user(&tmp, in, sizeof(tmp))) |
| 101 | 101 | return ERR_PTR(-EFAULT); |
| ... | ... | @@ -106,7 +106,11 @@ |
| 106 | 106 | if (tmp.size > (PATH_MAX + sizeof(tmp))) |
| 107 | 107 | return ERR_PTR(-ENAMETOOLONG); |
| 108 | 108 | |
| 109 | - return memdup_user(in, tmp.size); | |
| 109 | + res = memdup_user(in, tmp.size); | |
| 110 | + if (!IS_ERR(res)) | |
| 111 | + res->size = tmp.size; | |
| 112 | + | |
| 113 | + return res; | |
| 110 | 114 | } |
| 111 | 115 | |
| 112 | 116 | static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) |
