lkml.org 
[lkml]   [2012]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 171/179] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message
    Date
    From: Miklos Szeredi <mszeredi@suse.cz>

    -------------------
    This is a commit scheduled for the next v2.6.34 longterm release.
    http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
    If you see a problem with using this for longterm, please comment.
    -------------------

    commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream.

    FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the
    message processing could overrun and result in a "kernel BUG at
    fs/fuse/dev.c:629!"

    Reported-by: Han-Wen Nienhuys <hanwenn@gmail.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    fs/fuse/dev.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
    index c235afc..9897fe3 100644
    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -901,6 +901,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
    if (outarg.namelen > FUSE_NAME_MAX)
    goto err;

    + err = -EINVAL;
    + if (size != sizeof(outarg) + outarg.namelen + 1)
    + goto err;
    +
    name.name = buf;
    name.len = outarg.namelen;
    err = fuse_copy_one(cs, buf, outarg.namelen + 1);
    --
    1.7.9.6


    \
     
     \ /
      Last update: 2012-05-15 06:03    [W:4.256 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site