diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2018-04-08 11:57:10 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-19 08:54:12 +0200 |
commit | 848759157ab9be09f562842b51ed0d4c5b0f2e41 (patch) | |
tree | 1fe978b3222d8d88d71eb522a61ccec2c2df0a43 /fs | |
parent | c81e1b6b2cfb4d8b272c819e88aab1b4ee443543 (diff) |
getname_kernel() needs to make sure that ->name != ->iname in long case
commit 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be upstream.
missed it in "kill struct filename.separate" several years ago.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index cafa365eeb70..b61d6aa9279d 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -222,9 +222,10 @@ getname_kernel(const char * filename) if (len <= EMBEDDED_NAME_MAX) { result->name = (char *)result->iname; } else if (len <= PATH_MAX) { + const size_t size = offsetof(struct filename, iname[1]); struct filename *tmp; - tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); + tmp = kmalloc(size, GFP_KERNEL); if (unlikely(!tmp)) { __putname(result); return ERR_PTR(-ENOMEM); |