35 lines
1.0 KiB
Diff
35 lines
1.0 KiB
Diff
From 6a7fc984c7bd3c98839e28c47f4a9a27af024ca7 Mon Sep 17 00:00:00 2001
|
|
From: Miklos Szeredi <mszeredi@suse.cz>
|
|
Date: Wed, 24 Aug 2011 10:20:17 +0200
|
|
Subject: [PATCH] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message
|
|
|
|
FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
|
|
message processing could overrun and result in a "kernel BUG at
|
|
fs/fuse/dev.c:629!"
|
|
|
|
Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
|
|
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
|
|
CC: stable@kernel.org
|
|
---
|
|
fs/fuse/dev.c | 4 ++++
|
|
1 files changed, 4 insertions(+), 0 deletions(-)
|
|
|
|
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
|
|
index e5cdabf..517430a 100644
|
|
--- a/fs/fuse/dev.c
|
|
+++ b/fs/fuse/dev.c
|
|
@@ -1208,6 +1208,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
|
|
if (outarg.namelen > FUSE_NAME_MAX)
|
|
goto err;
|
|
|
|
+ err = -EINVAL;
|
|
+ if (size != sizeof(outarg) + outarg.namelen + 1)
|
|
+ goto err;
|
|
+
|
|
name.name = buf;
|
|
name.len = outarg.namelen;
|
|
err = fuse_copy_one(cs, buf, outarg.namelen + 1);
|
|
--
|
|
1.7.6
|
|
|