diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2018-04-08 17:57:10 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2018-04-08 17:57:10 +0200 |
| commit | 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be (patch) | |
| tree | fe8363d07b0f25e55575199eab2f880508b7afcb /fs/namei.c | |
| parent | make lookup_one_len() safe to use with directory locked shared (diff) | |
| download | linux-30ce4d1903e1d8a7ccd110860a5eef3c638ed8be.tar.xz linux-30ce4d1903e1d8a7ccd110860a5eef3c638ed8be.zip | |
getname_kernel() needs to make sure that ->name != ->iname in long case
missed it in "kill struct filename.separate" several years ago.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to '')
| -rw-r--r-- | fs/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index 6e0f6eea9896..3aefcf74f041 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -222,9 +222,10 @@ getname_kernel(const char * filename) if (len <= EMBEDDED_NAME_MAX) { result->name = (char *)result->iname; } else if (len <= PATH_MAX) { + const size_t size = offsetof(struct filename, iname[1]); struct filename *tmp; - tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); + tmp = kmalloc(size, GFP_KERNEL); if (unlikely(!tmp)) { __putname(result); return ERR_PTR(-ENOMEM); |