Skip to content

Commit

Permalink
fanotify: don't write with size under sizeof(response)
Browse files Browse the repository at this point in the history
fanotify_write() only aligned copy_from_user size to sizeof(response)
for higher values. This patch avoids all values below as suggested
by Amir Goldstein and set to response size unconditionally.

Link: https://lore.kernel.org/r/20200512181921.405973-1-fabf@skynet.be
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
  • Loading branch information
Fabian Frederick authored and jankara committed May 13, 2020
1 parent 5a44909 commit 5e23663
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions fs/notify/fanotify/fanotify_user.c
Original file line number Diff line number Diff line change
Expand Up @@ -487,8 +487,10 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t

group = file->private_data;

if (count > sizeof(response))
count = sizeof(response);
if (count < sizeof(response))
return -EINVAL;

count = sizeof(response);

pr_debug("%s: group=%p count=%zu\n", __func__, group, count);

Expand Down

0 comments on commit 5e23663

Please sign in to comment.