From: Ahmed S. Darwish <darwish.07@gmail.com>
Date: Thu, 13 Mar 2008 19:32:34 +0000 (-0700)
Subject: smackfs: do not trust `count' in inodes write()s
X-Git-Tag: v2.6.25-rc6~28
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b500ce8d24d1f14426643da5f6fada28c1f60533;p=pandora-kernel.git

smackfs: do not trust `count' in inodes write()s

Smackfs write() implementation does not put a higher bound on the number of
bytes to copy from user-space.  This may lead to a DOS attack if a malicious
`count' field is given.

Assure that given `count' is exactly the length needed for a /smack/load rule.
 In case of /smack/cipso where the length is relative, assure that `count'
does not exceed the size needed for a buffer representing maximum possible
number of CIPSO 2.2 categories.

Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

Reading git-diff-tree failed