ntfs3_label_write() allocates as many bytes as are written with plain
kmalloc(). A write that is larger than what kmalloc() can hand out then
trips the page allocator's warning, which panics a panic_on_warn kernel.
Use memdup_user(), which fails such an allocation quietly with -ENOMEM
like before.
Fixes: 7832e123490a ("fs/ntfs3: Add support /proc/fs/ntfs3/<dev>/volinfo and /proc/fs/ntfs3/<dev>/label")
Cc: <redacted>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
fs/ntfs3/super.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index 58ef6be3286b..b4479cd6bd65 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -552,15 +552,10 @@ static ssize_t ntfs3_label_write(struct file *file, const char __user *buffer,
if (sb_rdonly(sb))
return -EROFS;
- label = kmalloc(count, GFP_NOFS);
+ label = memdup_user(buffer, count);
+ if (IS_ERR(label))
+ return PTR_ERR(label);
- if (!label)
- return -ENOMEM;
-
- if (copy_from_user(label, buffer, ret)) {
- ret = -EFAULT;
- goto out;
- }
while (ret > 0 && label[ret - 1] == '\n')
ret -= 1;
--
2.53.0