Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be9eb995 authored by Al Viro's avatar Al Viro Committed by Sasha Levin
Browse files

autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for allocation 



commit 0a280962dc6e117e0e4baa668453f753579265d9 upstream.

X-Coverup: just ask spender
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent 318dc9ce

fs/autofs4/dev-ioctl.c

+6 −2
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param) 
 */

static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)

{

	struct autofs_dev_ioctl tmp;

	struct autofs_dev_ioctl tmp, *res;



	if (copy_from_user(&tmp, in, sizeof(tmp)))

		return ERR_PTR(-EFAULT);
@@ -106,7 +106,11 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i 
	if (tmp.size > (PATH_MAX + sizeof(tmp)))

		return ERR_PTR(-ENAMETOOLONG);



	return memdup_user(in, tmp.size);

	res = memdup_user(in, tmp.size);

	if (!IS_ERR(res))

		res->size = tmp.size;



	return res;

}



static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)