Commit 960534a5 authored Apr 08, 2018 by Al Viro Committed by Greg Kroah-Hartman Apr 20, 2018

getname_kernel() needs to make sure that ->name != ->iname in long case



commit 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be upstream.

missed it in "kill struct filename.separate" several years ago.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent d6bcc215

fs/namei.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -221,9 +221,10 @@ getname_kernel(const char * filename)
		if (len <= EMBEDDED_NAME_MAX) {
		result->name = (char *)result->iname;
		} else if (len <= PATH_MAX) {
		const size_t size = offsetof(struct filename, iname[1]);
		struct filename *tmp;

		tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
		tmp = kmalloc(size, GFP_KERNEL);
		if (unlikely(!tmp)) {
		__putname(result);
		return ERR_PTR(-ENOMEM);