Commit 261eba73 authored Jul 30, 2012 by Alan Cox Committed by Linus Torvalds Jul 30, 2012

drivers/message/i2o/i2o_config.c: bound allocation



Fix a case where users can try to allocate arbitarily large amounts of
memory. 64K is overkill for a config request so apply an upper bound.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 40251b8e

drivers/message/i2o/i2o_config.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -188,6 +188,13 @@ static int i2o_cfg_parms(unsigned long arg, unsigned int type)
		if (!dev)
		return -ENXIO;

		/*
		* Stop users being able to try and allocate arbitary amounts
		* of DMA space. 64K is way more than sufficient for this.
		*/
		if (kcmd.oplen > 65536)
		return -EMSGSIZE;

		ops = memdup_user(kcmd.opbuf, kcmd.oplen);
		if (IS_ERR(ops))
		return PTR_ERR(ops);