drivers/message/i2o/i2o_config.c: bound allocation

Fix a case where users can try to allocate arbitarily large amounts of
memory. 64K is overkill for a config request so apply an upper bound.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index 098de2b35784..9a49c243a6ac 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -188,6 +188,13 @@ static int i2o_cfg_parms(unsigned long arg, unsigned int type)
         if (!dev)
                 return -ENXIO;
 
+        /*
+         * Stop users being able to try and allocate arbitary amounts
+         * of DMA space. 64K is way more than sufficient for this.
+         */
+        if (kcmd.oplen > 65536)
+                return -EMSGSIZE;
+
         ops = memdup_user(kcmd.opbuf, kcmd.oplen);
         if (IS_ERR(ops))
                 return PTR_ERR(ops);