vfs: cap dedupe request structure size at PAGE_SIZE

[linux-2.6-block.git] / fs / ioctl.c

diff --git a/fs/ioctl.c b/fs/ioctl.c
index 26aba0942a98357c824b7ed97df977458ab6def6..c415668c86d4cc727460ae0f0eb5a6d1f5840f61 100644 (file)
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -582,6 +582,10 @@ static int ioctl_file_dedupe_range(struct file *file, void __user *arg)
        }
 
        size = offsetof(struct file_dedupe_range __user, info[count]);
+       if (size > PAGE_SIZE) {
+               ret = -ENOMEM;
+               goto out;
+       }
 
        same = memdup_user(argp, size);
        if (IS_ERR(same)) {