From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933121AbbFPIzz (ORCPT ); Tue, 16 Jun 2015 04:55:55 -0400 Received: from mail.kernel.org ([198.145.29.136]:57241 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932823AbbFPIty (ORCPT ); Tue, 16 Jun 2015 04:49:54 -0400 From: lizf@kernel.org To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Sasha Levin , Ian Kent , Andrew Morton , Linus Torvalds , Zefan Li Subject: [PATCH 3.4 162/172] autofs4: check dev ioctl size before allocating Date: Tue, 16 Jun 2015 16:36:56 +0800 Message-Id: <1434443826-4929-162-git-send-email-lizf@kernel.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1434443587-4599-1-git-send-email-lizf@kernel.org> References: <1434443587-4599-1-git-send-email-lizf@kernel.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sasha Levin 3.4.108-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit e53d77eb8bb616e903e34cc7a918401bee3b5149 upstream. There wasn't any check of the size passed from userspace before trying to allocate the memory required. This meant that userspace might request more space than allowed, triggering an OOM. Signed-off-by: Sasha Levin Signed-off-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li --- fs/autofs4/dev-ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c index fbaa428..ace3eea 100644 --- a/fs/autofs4/dev-ioctl.c +++ b/fs/autofs4/dev-ioctl.c @@ -103,6 +103,9 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i if (tmp.size < sizeof(tmp)) return ERR_PTR(-EINVAL); + if (tmp.size > (PATH_MAX + sizeof(tmp))) + return ERR_PTR(-ENAMETOOLONG); + res = memdup_user(in, tmp.size); if (!IS_ERR(res)) res->size = tmp.size; -- 1.9.1