diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2018-04-08 18:57:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-19 09:56:19 +0300 |
| commit | c3efeaa3b15403eb17b693a66c6a297ac459a020 (patch) | |
| tree | e113f015d49684a4050350435b4615441166ba4a /fs/namei.c | |
| parent | adea72f0e570500f6f78343550950dcbb73e1a19 (diff) | |
| download | linux-c3efeaa3b15403eb17b693a66c6a297ac459a020.tar.xz | |
getname_kernel() needs to make sure that ->name != ->iname in long case
commit 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be upstream.
missed it in "kill struct filename.separate" several years ago.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/namei.c')
| -rw-r--r-- | fs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index f839b0750ca3..0b46b858cd42 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -222,9 +222,10 @@ getname_kernel(const char * filename) if (len <= EMBEDDED_NAME_MAX) { result->name = (char *)result->iname; } else if (len <= PATH_MAX) { + const size_t size = offsetof(struct filename, iname[1]); struct filename *tmp; - tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); + tmp = kmalloc(size, GFP_KERNEL); if (unlikely(!tmp)) { __putname(result); return ERR_PTR(-ENOMEM); |