diff options
| author | Colin Cross <ccross@android.com> | 2013-03-13 17:16:02 -0700 |
|---|---|---|
| committer | Colin Cross <ccross@android.com> | 2013-03-13 17:16:02 -0700 |
| commit | 0b203ab4aacdb6e6dfb8c277aa290f0a02428e6f (patch) | |
| tree | 9bab760a750d9cf4504d92603ee7fc82beeb2e38 /drivers/md | |
| parent | a276def548828763cf5ac228adf8c1ca73f8d4d3 (diff) | |
| parent | e28c3f2b514b5581e15614f7cf976131092cf4b6 (diff) | |
| download | kernel_samsung_tuna-0b203ab4aacdb6e6dfb8c277aa290f0a02428e6f.zip kernel_samsung_tuna-0b203ab4aacdb6e6dfb8c277aa290f0a02428e6f.tar.gz kernel_samsung_tuna-0b203ab4aacdb6e6dfb8c277aa290f0a02428e6f.tar.bz2 | |
Merge tag 'v3.0.68' into android-3.0
This is the 3.0.68 stable release
Conflicts:
kernel/cgroup.c
Change-Id: I067982d25e18e3a12de93a5eb6429b8829d7ca11
Diffstat (limited to 'drivers/md')
| -rw-r--r-- | drivers/md/dm-ioctl.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 4cacdad..bd3b294 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1524,6 +1524,14 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param) if (copy_from_user(dmi, user, tmp.data_size)) goto bad; + /* + * Abort if something changed the ioctl data while it was being copied. + */ + if (dmi->data_size != tmp.data_size) { + DMERR("rejecting ioctl: data size modified while processing parameters"); + goto bad; + } + /* Wipe the user buffer so we do not return it to userspace */ if (secure_data && clear_user(user, tmp.data_size)) goto bad; |