1 files changed, 13 insertions, 9 deletions

diff --git a/fs/autofs/dev-ioctl.c b/fs/autofs/dev-ioctl.c
index ea4ca1445ab7..86eafda4a652 100644
--- a/fs/autofs/dev-ioctl.c
+++ b/fs/autofs/dev-ioctl.c
@@ -135,6 +135,15 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param)
                                 cmd);
                         goto out;
                 }
+        } else {
+                unsigned int inr = _IOC_NR(cmd);
+
+                if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD ||
+                    inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD ||
+                    inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) {
+                        err = -EINVAL;
+                        goto out;
+                }
         }
 
         err = 0;
@@ -271,7 +280,8 @@ static int autofs_dev_ioctl_openmount(struct file *fp,
         dev_t devid;
         int err, fd;
 
-        /* param->path has already been checked */
+        /* param->path has been checked in validate_dev_ioctl() */
+
         if (!param->openmount.devid)
                 return -EINVAL;
 
@@ -433,10 +443,7 @@ static int autofs_dev_ioctl_requester(struct file *fp,
         dev_t devid;
         int err = -ENOENT;
 
-        if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
-                err = -EINVAL;
-                goto out;
-        }
+        /* param->path has been checked in validate_dev_ioctl() */
 
         devid = sbi->sb->s_dev;
 
@@ -521,10 +528,7 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
         unsigned int devid, magic;
         int err = -ENOENT;
 
-        if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
-                err = -EINVAL;
-                goto out;
-        }
+        /* param->path has been checked in validate_dev_ioctl() */
 
         name = param->path;
         type = param->ismountpoint.in.type;