commit db10e556518eb9d21ee92ff944530d84349684f4
author Tyler Hicks <tyhicks@canonical.com> Thu Jan 12 11:30:44 2012 +0100
committer Tyler Hicks <tyhicks@canonical.com> Wed Jan 25 14:43:39 2012 -0600
tree 84a82f496a4fe4ee90812b5d7f2cd358f9730911
parent bb4503615d95d6826b7907986ad574e3157877e8

eCryptfs: Sanitize write counts of /dev/ecryptfs

A malicious count value specified when writing to /dev/ecryptfs may
result in a a very large kernel memory allocation.

This patch peeks at the specified packet payload size, adds that to the
size of the packet headers and compares the result with the write count
value. The resulting maximum memory allocation size is approximately 532
bytes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Cc: <stable@vger.kernel.org>