Commit 5e23663b authored by Fabian Frederick's avatar Fabian Frederick Committed by Jan Kara

fanotify: don't write with size under sizeof(response)

fanotify_write() only aligned copy_from_user size to sizeof(response)
for higher values. This patch avoids all values below as suggested
by Amir Goldstein and set to response size unconditionally.

Link: https://lore.kernel.org/r/20200512181921.405973-1-fabf@skynet.beSigned-off-by: default avatarFabian Frederick <fabf@skynet.be>
Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 5a449099
...@@ -487,7 +487,9 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t ...@@ -487,7 +487,9 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t
group = file->private_data; group = file->private_data;
if (count > sizeof(response)) if (count < sizeof(response))
return -EINVAL;
count = sizeof(response); count = sizeof(response);
pr_debug("%s: group=%p count=%zu\n", __func__, group, count); pr_debug("%s: group=%p count=%zu\n", __func__, group, count);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment