releases/3.19.2/autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch

   1 From 0a280962dc6e117e0e4baa668453f753579265d9 Mon Sep 17 00:00:00 2001
   2 From: Al Viro <viro@zeniv.linux.org.uk>
   3 Date: Sat, 21 Feb 2015 22:19:57 -0500
   4 Subject: autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for allocation
   5
   6 From: Al Viro <viro@zeniv.linux.org.uk>
   7
   8 commit 0a280962dc6e117e0e4baa668453f753579265d9 upstream.
   9
  10 X-Coverup: just ask spender
  11 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  12 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  13
  14 ---
  15  fs/autofs4/dev-ioctl.c |    8 ++++++--
  16  1 file changed, 6 insertions(+), 2 deletions(-)
  17
  18 --- a/fs/autofs4/dev-ioctl.c
  19 +++ b/fs/autofs4/dev-ioctl.c
  20 @@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int c
  21   */
  22  static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
  23  {
  24 -       struct autofs_dev_ioctl tmp;
  25 +       struct autofs_dev_ioctl tmp, *res;
  26
  27         if (copy_from_user(&tmp, in, sizeof(tmp)))
  28                 return ERR_PTR(-EFAULT);
  29 @@ -106,7 +106,11 @@ static struct autofs_dev_ioctl *copy_dev
  30         if (tmp.size > (PATH_MAX + sizeof(tmp)))
  31                 return ERR_PTR(-ENAMETOOLONG);
  32
  33 -       return memdup_user(in, tmp.size);
  34 +       res = memdup_user(in, tmp.size);
  35 +       if (!IS_ERR(res))
  36 +               res->size = tmp.size;
  37 +
  38 +       return res;
  39  }
  40
  41  static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)