commit 900469d0b0c337db19908f77d172f4b17f4573ba
author José Adolfo Galdámez <josegalre@pac-rom.com> Sat Jun 20 23:45:36 2015 -0600
committer William Bellavance <flintman@flintmancomputers.com> Wed Feb 10 20:02:51 2016 -0500
tree e7c8e6e70ad09ecc74c7385269f9a7a908489b88
parent 3591a444f6b8cb82a9b88a49a4e67d8f4b61a6de

Merge tag 'v3.4.108' into mm-6.0

Change-Id: I5ee718e5c87c9647c6edf0926a887679e065a649
Signed-off-by: José Adolfo Galdámez <josegalre@pac-rom.com>

fs/autofs4/dev-ioctl.c

diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index aa9103f..ace3eea 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -95,7 +95,7 @@
  */
 static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
 {
-	struct autofs_dev_ioctl tmp;
+	struct autofs_dev_ioctl tmp, *res;
 
 	if (copy_from_user(&tmp, in, sizeof(tmp)))
 		return ERR_PTR(-EFAULT);
@@ -103,7 +103,14 @@
 	if (tmp.size < sizeof(tmp))
 		return ERR_PTR(-EINVAL);
 
-	return memdup_user(in, tmp.size);
+	if (tmp.size > (PATH_MAX + sizeof(tmp)))
+		return ERR_PTR(-ENAMETOOLONG);
+
+	res = memdup_user(in, tmp.size);
+	if (!IS_ERR(res))
+		res->size = tmp.size;
+
+	return res;
 }
 
 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)