Commit 42857cf5 authored Sep 15, 2016 by Phil Turnbull Committed by Christoph Hellwig Sep 16, 2016

configfs: Return -EFBIG from configfs_write_bin_file.



The check for writing more than cb_max_size bytes does not 'goto out' so
it is a no-op which allows users to vmalloc an arbitrary amount.

Fixes: 03607ace ("configfs: implement binary attributes")
Cc: stable@kernel.org
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

parent 024c7e37

fs/configfs/file.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -333,6 +333,7 @@ configfs_write_bin_file(struct file file, const char __user buf,
		if (bin_attr->cb_max_size &&
		*ppos + count > bin_attr->cb_max_size) {
		len = -EFBIG;
		goto out;
		}

		tbuf = vmalloc(*ppos + count);