]> git.baikalelectronics.ru Git - kernel.git/commit
eCryptfs: Sanitize write counts of /dev/ecryptfs
authorTyler Hicks <tyhicks@canonical.com>
Thu, 12 Jan 2012 10:30:44 +0000 (11:30 +0100)
committerTyler Hicks <tyhicks@canonical.com>
Wed, 25 Jan 2012 20:43:39 +0000 (14:43 -0600)
commitac04033849e5141e81f48ce463bed7504d531553
tree84a82f496a4fe4ee90812b5d7f2cd358f9730911
parentbf902e0d7aca5a0dc77b5b8cdd009df96d06735f
eCryptfs: Sanitize write counts of /dev/ecryptfs

A malicious count value specified when writing to /dev/ecryptfs may
result in a a very large kernel memory allocation.

This patch peeks at the specified packet payload size, adds that to the
size of the packet headers and compares the result with the write count
value. The resulting maximum memory allocation size is approximately 532
bytes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Cc: <stable@vger.kernel.org>
fs/ecryptfs/miscdev.c