kernel/include/linux/uaccess.h
.. .. @@ -348,6 +348,10 @@ 348 348 size_t size = min(ksize, usize); 349 349 size_t rest = max(ksize, usize) - size; 350 350 351 + /* Double check if ksize is larger than a known object size. */352 + if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1)))353 + return -E2BIG;354 +351 355 /* Deal with trailing bytes. */ 352 356 if (usize < ksize) { 353 357 memset(dst + size, 0, rest);