summaryrefslogtreecommitdiff
path: root/fs/fuse
diff options
context:
space:
mode:
authorZach Brown <zab@redhat.com>2012-07-24 12:10:11 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-08-26 15:00:39 -0700
commit90f9cb724d38bf4ac4e355d19b1ee697dceea021 (patch)
treec40e362d46c39e709d42f94b8a53ee35ed3cb78b /fs/fuse
parent9ea2c02bafe276e97b592a046ac733610a6d57fd (diff)
fuse: verify all ioctl retry iov elements
commit fb6ccff667712c46b4501b920ea73a326e49626a upstream. Commit 7572777eef78ebdee1ecb7c258c0ef94d35bad16 attempted to verify that the total iovec from the client doesn't overflow iov_length() but it only checked the first element. The iovec could still overflow by starting with a small element. The obvious fix is to check all the elements. The overflow case doesn't look dangerous to the kernel as the copy is limited by the length after the overflow. This fix restores the intention of returning an error instead of successfully copying less than the iovec represented. I found this by code inspection. I built it but don't have a test case. I'm cc:ing stable because the initial commit did as well. Signed-off-by: Zach Brown <zab@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/fuse')
-rw-r--r--fs/fuse/file.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 504e61b7fd75..8e6381a14265 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1698,7 +1698,7 @@ static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
size_t n;
u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
- for (n = 0; n < count; n++) {
+ for (n = 0; n < count; n++, iov++) {
if (iov->iov_len > (size_t) max)
return -ENOMEM;
max -= iov->iov_len;