hc
2024-01-05 071106ecf68c401173c58808b1cf5f68cc50d390
kernel/include/linux/uaccess.h
....@@ -348,6 +348,10 @@
348348 size_t size = min(ksize, usize);
349349 size_t rest = max(ksize, usize) - size;
350350
351
+ /* Double check if ksize is larger than a known object size. */
352
+ if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1)))
353
+ return -E2BIG;
354
+
351355 /* Deal with trailing bytes. */
352356 if (usize < ksize) {
353357 memset(dst + size, 0, rest);