diff options
| author | Todd Poynor <toddpoynor@google.com> | 2013-03-13 17:35:08 -0700 |
|---|---|---|
| committer | Todd Poynor <toddpoynor@google.com> | 2013-03-13 17:35:08 -0700 |
| commit | 1249d25539343d1a7fe361c8d40be7a5df5b0216 (patch) | |
| tree | 770c9a33604bb00c62f44d780aefab27e4eb9379 /drivers/md/dm-ioctl.c | |
| parent | 4aad13d07babf68c1d0d37ff1e5f797573c4fd2a (diff) | |
| parent | 0b203ab4aacdb6e6dfb8c277aa290f0a02428e6f (diff) | |
| download | kernel_samsung_tuna-1249d25539343d1a7fe361c8d40be7a5df5b0216.zip kernel_samsung_tuna-1249d25539343d1a7fe361c8d40be7a5df5b0216.tar.gz kernel_samsung_tuna-1249d25539343d1a7fe361c8d40be7a5df5b0216.tar.bz2 | |
Merge branch 'android-3.0' into android-omap-3.0
Diffstat (limited to 'drivers/md/dm-ioctl.c')
| -rw-r--r-- | drivers/md/dm-ioctl.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 4cacdad..bd3b294 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1524,6 +1524,14 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param) if (copy_from_user(dmi, user, tmp.data_size)) goto bad; + /* + * Abort if something changed the ioctl data while it was being copied. + */ + if (dmi->data_size != tmp.data_size) { + DMERR("rejecting ioctl: data size modified while processing parameters"); + goto bad; + } + /* Wipe the user buffer so we do not return it to userspace */ if (secure_data && clear_user(user, tmp.data_size)) goto bad; |