* [PATCH V2 6/6 linux-next] fanotify: don't write with size under sizeof(response)
@ 2020-05-12 18:19 Fabian Frederick
0 siblings, 0 replies; only message in thread
From: Fabian Frederick @ 2020-05-12 18:19 UTC (permalink / raw)
To: jack, amir73il; +Cc: linux-fsdevel, Fabian Frederick
fanotify_write() only aligned copy_from_user size to sizeof(response)
for higher values. This patch avoids all values below as suggested
by Amir Goldstein and set to response size unconditionally.
Signed-off-by: Fabian Frederick <fabf@skynet.be>
---
V2: don't write with size under sizeof(response), not only 0
fs/notify/fanotify/fanotify_user.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 02a314acc757..63b5dffdca9e 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -487,8 +487,10 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t
group = file->private_data;
- if (count > sizeof(response))
- count = sizeof(response);
+ if (count < sizeof(response))
+ return -EINVAL;
+
+ count = sizeof(response);
pr_debug("%s: group=%p count=%zu\n", __func__, group, count);
--
2.26.2
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2020-05-12 18:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-12 18:19 [PATCH V2 6/6 linux-next] fanotify: don't write with size under sizeof(response) Fabian Frederick
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).