提交 d4b0bcf3 编写于 作者: D David Teigland

dlm: check the write size from user

Return EINVAL from write if the size is larger than
allowed.  Do this before allocating kernel memory for
the bogus size, which could lead to OOM.
Reported-by: NSasha Levin <levinsasha928@gmail.com>
Tested-by: NJana Saout <jana@saout.de>
Signed-off-by: NDavid Teigland <teigland@redhat.com>
上级 6edacf05
......@@ -503,11 +503,11 @@ static ssize_t device_write(struct file *file, const char __user *buf,
#endif
return -EINVAL;
#ifdef CONFIG_COMPAT
if (count > sizeof(struct dlm_write_request32) + DLM_RESNAME_MAXLEN)
#else
/*
* can't compare against COMPAT/dlm_write_request32 because
* we don't yet know if is64bit is zero
*/
if (count > sizeof(struct dlm_write_request) + DLM_RESNAME_MAXLEN)
#endif
return -EINVAL;
kbuf = kzalloc(count + 1, GFP_NOFS);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册