Commit e53d77eb authored by Sasha Levin's avatar Sasha Levin Committed by Linus Torvalds
Browse files

autofs4: check dev ioctl size before allocating

There wasn't any check of the size passed from userspace before trying
to allocate the memory required.

This meant that userspace might request more space than allowed,
triggering an OOM.
Signed-off-by: default avatarSasha Levin <>
Signed-off-by: default avatarIan Kent <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 0bf1457f
...@@ -103,6 +103,9 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i ...@@ -103,6 +103,9 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
if (tmp.size < sizeof(tmp)) if (tmp.size < sizeof(tmp))
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
if (tmp.size > (PATH_MAX + sizeof(tmp)))
return memdup_user(in, tmp.size); return memdup_user(in, tmp.size);
} }
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment