From 10eec60ce79187686e052092e5383c99b4420a20 Mon Sep 17 00:00:00 2001 From: Scott Bauer Date: Wed, 27 Jul 2016 19:11:29 -0600 Subject: vfs: ioctl: prevent double-fetch in dedupe ioctl This prevents a double-fetch from user space that can lead to to an undersized allocation and heap overflow. Fixes: 54dbc1517237 ("vfs: hoist the btrfs deduplication ioctl to the vfs") Signed-off-by: Scott Bauer Signed-off-by: Linus Torvalds --- fs/ioctl.c | 1 + 1 file changed, 1 insertion(+) (limited to 'fs/ioctl.c') diff --git a/fs/ioctl.c b/fs/ioctl.c index 116a333e9c77..0f56deb24ce6 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg) goto out; } + same->dest_count = count; ret = vfs_dedupe_file_range(file, same); if (ret) goto out; -- cgit v1.2.3