Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a280962 authored by Al Viro's avatar Al Viro
Browse files

autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for allocation 



X-Coverup: just ask spender
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 7e0e953b

fs/autofs4/dev-ioctl.c

+6 −2
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) 
 */

static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)

{

	struct autofs_dev_ioctl tmp;

	struct autofs_dev_ioctl tmp, *res;



	if (copy_from_user(&tmp, in, sizeof(tmp)))

		return ERR_PTR(-EFAULT);
@@ -106,7 +106,11 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i 
	if (tmp.size > (PATH_MAX + sizeof(tmp)))

		return ERR_PTR(-ENAMETOOLONG);



	return memdup_user(in, tmp.size);

	res = memdup_user(in, tmp.size);

	if (!IS_ERR(res))

		res->size = tmp.size;



	return res;

}



static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)