diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-19 09:06:37 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-19 09:06:37 +0100 |
| commit | 36d97cdaf46593330067c34ed3639d0556d4fd6d (patch) | |
| tree | 8f15f5dc52d5c0a045751b8dd20768bd8a11605f /security/security.c | |
| parent | 548fcf037b3f8592e9fe41469110453a777416d6 (diff) | |
| parent | b401b621758e46812da61fa58a67c3fd8d91de0d (diff) | |
| download | linux-stable-36d97cdaf46593330067c34ed3639d0556d4fd6d.tar.gz linux-stable-36d97cdaf46593330067c34ed3639d0556d4fd6d.tar.bz2 linux-stable-36d97cdaf46593330067c34ed3639d0556d4fd6d.zip | |
Merge 6.8-rc5 into tty-next
We need the serial/tty fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security/security.c')
| -rw-r--r-- | security/security.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/security/security.c b/security/security.c index 3aaad75c9ce8..7035ee35a393 100644 --- a/security/security.c +++ b/security/security.c @@ -29,6 +29,7 @@ #include <linux/backing-dev.h> #include <linux/string.h> #include <linux/msg.h> +#include <linux/overflow.h> #include <net/flow.h> /* How many LSMs were built into the kernel? */ @@ -4015,6 +4016,7 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, struct security_hook_list *hp; struct lsm_ctx *lctx; int rc = LSM_RET_DEFAULT(setselfattr); + u64 required_len; if (flags) return -EINVAL; @@ -4027,8 +4029,9 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, if (IS_ERR(lctx)) return PTR_ERR(lctx); - if (size < lctx->len || size < lctx->ctx_len + sizeof(*lctx) || - lctx->len < lctx->ctx_len + sizeof(*lctx)) { + if (size < lctx->len || + check_add_overflow(sizeof(*lctx), lctx->ctx_len, &required_len) || + lctx->len < required_len) { rc = -EINVAL; goto free_out; } |