lkml.org 
[lkml]   [2011]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[18/19] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Miklos Szeredi <mszeredi@suse.cz>

    commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream.

    FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
    message processing could overrun and result in a "kernel BUG at
    fs/fuse/dev.c:629!"

    Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/fuse/dev.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -899,6 +899,10 @@ static int fuse_notify_inval_entry(struc
    if (outarg.namelen > FUSE_NAME_MAX)
    goto err;

    + err = -EINVAL;
    + if (size != sizeof(outarg) + outarg.namelen + 1)
    + goto err;
    +
    name.name = buf;
    name.len = outarg.namelen;
    err = fuse_copy_one(cs, buf, outarg.namelen + 1);



    \
     
     \ /
      Last update: 2011-08-27 16:59    [W:0.017 / U:60.244 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site