diff options
| author |  Daniel Vetter <daniel.vetter@ffwll.ch>
| 2024-02-26 11:41:07 +0100 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch>
| 2024-02-26 11:41:07 +0100 |
| commit | f112b68f273fb0121cb64e0c3ac06adcb91e32b8 (patch) | |
| tree | 8e5ca44719c39e6d37d9a85c6c1b5759952e3da7 /security | |
| parent | Merge tag 'drm-habanalabs-next-2024-02-26' of https://git.kernel.org/pub/scm/... (diff) | |
| parent | Linux 6.8-rc6 (diff) | |
| download | linux-f112b68f273fb0121cb64e0c3ac06adcb91e32b8.tar.gz linux-f112b68f273fb0121cb64e0c3ac06adcb91e32b8.tar.bz2 linux-f112b68f273fb0121cb64e0c3ac06adcb91e32b8.zip | |
Merge v6.8-rc6 into drm-next
Thomas Zimmermann asked to backmerge -rc6 for drm-misc branches,
there's a few same-area-changed conflicts (xe and amdgpu mostly) that
are getting a bit too annoying.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'security')
| -rw-r--r-- | security/security.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/security/security.c b/security/security.c index 3aaad75c9ce8..7035ee35a393 100644 --- a/security/security.c +++ b/security/security.c @@ -29,6 +29,7 @@ #include <linux/backing-dev.h> #include <linux/string.h> #include <linux/msg.h> +#include <linux/overflow.h> #include <net/flow.h> /* How many LSMs were built into the kernel? */ @@ -4015,6 +4016,7 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, struct security_hook_list *hp; struct lsm_ctx *lctx; int rc = LSM_RET_DEFAULT(setselfattr); + u64 required_len; if (flags) return -EINVAL; @@ -4027,8 +4029,9 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, if (IS_ERR(lctx)) return PTR_ERR(lctx); - if (size < lctx->len || size < lctx->ctx_len + sizeof(*lctx) || - lctx->len < lctx->ctx_len + sizeof(*lctx)) { + if (size < lctx->len || + check_add_overflow(sizeof(*lctx), lctx->ctx_len, &required_len) || + lctx->len < required_len) { rc = -EINVAL; goto free_out; } |