Eric Lee / linux-smarc-t335x-v3.2

Download as
Browse Code ยป

Commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae

Authored by Miklos Szeredi
1 parent 478e0841b3
Exists in master and in 4 other branches v3.2_AM335xPSP_04.06.00.11, v3.2_NEWT335xPSP_04.06.00.11, v3.2_SBC_SMARTMEN, v3.2_SMARCT335xPSP_04.06.00.11

fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message 

FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
message processing could overrun and result in a "kernel BUG at
fs/fuse/dev.c:629!"

Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org

Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff

... ... @@ -1358,6 +1358,10 @@
1358 1358 if (outarg.namelen > FUSE_NAME_MAX)
1359 1359 goto err;
1360 1360  
  1361 + err = -EINVAL;
  1362 + if (size != sizeof(outarg) + outarg.namelen + 1)
  1363 + goto err;
  1364 +
1361 1365 name.name = buf;
1362 1366 name.len = outarg.namelen;
1363 1367 err = fuse_copy_one(cs, buf, outarg.namelen + 1);