dlm: check the write size from user

Return EINVAL from write if the size is larger than allowed. Do this before allocating kernel memory for the bogus size, which could lead to OOM. Reported-by: Sasha Levin <[email protected]> Tested-by: Jana Saout <[email protected]> Signed-off-by: David Teigland <[email protected]>
ambv · Feb 4, 2013 · d4b0bcf · d4b0bcf
1 parent 6edacf0
commit d4b0bcf
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
@@ -503,11 +503,11 @@ static ssize_t device_write(struct file *file, const char __user *buf,
 #endif
 		return -EINVAL;
 
-#ifdef CONFIG_COMPAT
-	if (count > sizeof(struct dlm_write_request32) + DLM_RESNAME_MAXLEN)
-#else
+	/*
+	 * can't compare against COMPAT/dlm_write_request32 because
+	 * we don't yet know if is64bit is zero
+	 */
 	if (count > sizeof(struct dlm_write_request) + DLM_RESNAME_MAXLEN)
-#endif
 		return -EINVAL;
 
 	kbuf = kzalloc(count + 1, GFP_NOFS);