diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2018-04-08 18:57:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-20 09:21:07 +0300 |
| commit | 960534a57db826558ba5eece275c81d8122eb6db (patch) | |
| tree | b215d006317cdaf407c518ef800608f30b772ae0 /fs/namei.c | |
| parent | d6bcc2153ba7649a8c742889489dbd5b4f3208cc (diff) | |
| download | linux-960534a57db826558ba5eece275c81d8122eb6db.tar.xz | |
getname_kernel() needs to make sure that ->name != ->iname in long case
commit 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be upstream.
missed it in "kill struct filename.separate" several years ago.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/namei.c')
| -rw-r--r-- | fs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index 891670e0956b..85ac38b99065 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -221,9 +221,10 @@ getname_kernel(const char * filename) if (len <= EMBEDDED_NAME_MAX) { result->name = (char *)result->iname; } else if (len <= PATH_MAX) { + const size_t size = offsetof(struct filename, iname[1]); struct filename *tmp; - tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); + tmp = kmalloc(size, GFP_KERNEL); if (unlikely(!tmp)) { __putname(result); return ERR_PTR(-ENOMEM); |