The patch titled
Subject: drivers/message/i2o/i2o_config.c: bound allocation
has been removed from the -mm tree. Its filename was
drivers-message-i2o-i2o_configc-bound-allocation.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Alan Cox <alan@xxxxxxxxxxxxxxx>
Subject: drivers/message/i2o/i2o_config.c: bound allocation
Fix a case where users can try to allocate arbitarily large amounts of
memory. 64K is overkill for a config request so apply an upper bound.
Signed-off-by: Alan Cox <alan@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/message/i2o/i2o_config.c | 7 +++++++
1 file changed, 7 insertions(+)
diff -puN drivers/message/i2o/i2o_config.c~drivers-message-i2o-i2o_configc-bound-allocation drivers/message/i2o/i2o_config.c
--- a/drivers/message/i2o/i2o_config.c~drivers-message-i2o-i2o_configc-bound-allocation
+++ a/drivers/message/i2o/i2o_config.c
@@ -188,6 +188,13 @@ static int i2o_cfg_parms(unsigned long a
if (!dev)
return -ENXIO;
+ /*
+ * Stop users being able to try and allocate arbitary amounts
+ * of DMA space. 64K is way more than sufficient for this.
+ */
+ if (kcmd.oplen > 65536)
+ return -EMSGSIZE;
+
ops = memdup_user(kcmd.opbuf, kcmd.oplen);
if (IS_ERR(ops))
return PTR_ERR(ops);
_
Patches currently in -mm which might be from alan@xxxxxxxxxxxxxxx are
origin.patch
linux-next.patch
ppc-e500_tlb-memset-clears-nothing.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
