redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

configfs: Return -EFBIG from configfs_write_bin_file. 

The check for writing more than cb_max_size bytes does not 'goto out' so
it is a no-op which allows users to vmalloc an arbitrary amount.

Fixes: 03607ace80 ("configfs: implement binary attributes")
Cc: stable@kernel.org
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
hifive-unleashed-5.1
Phil Turnbull 2016-09-15 12:20:12 -04:00 committed by Christoph Hellwig
parent 024c7e3756
commit 42857cf512
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fs/configfs/file.c
View File

@ -333,6 +333,7 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
if (bin_attr->cb_max_size &&
*ppos + count > bin_attr->cb_max_size) {
len = -EFBIG;
goto out;
}
tbuf = vmalloc(*ppos + count);