Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 7b1ef6c0a199bd93899f167f459627dd9421913a

Authored by Miklos Szeredi
Committed by Greg Kroah-Hartman
1 parent 035fac5844

fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message 

commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream.

FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
message processing could overrun and result in a "kernel BUG at
fs/fuse/dev.c:629!"

Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff

... ... @@ -899,6 +899,10 @@
899 899 if (outarg.namelen > FUSE_NAME_MAX)
900 900 goto err;
901 901  
  902 + err = -EINVAL;
  903 + if (size != sizeof(outarg) + outarg.namelen + 1)
  904 + goto err;
  905 +
902 906 name.name = buf;
903 907 name.len = outarg.namelen;
904 908 err = fuse_copy_one(cs, buf, outarg.namelen + 1);