autofs4: check dev ioctl size before allocating

[linux.git] / fs / autofs4 / dev-ioctl.c

diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 3182c0e68b4204cb2aec089b5d960b7053534757..232e03d4780d1b51386e72ab8df7e65af279e8ff 100644 (file)
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -103,6 +103,9 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
        if (tmp.size < sizeof(tmp))
                return ERR_PTR(-EINVAL);
 
+       if (tmp.size > (PATH_MAX + sizeof(tmp)))
+               return ERR_PTR(-ENAMETOOLONG);
+
        return memdup_user(in, tmp.size);
 }