lkml.org 
[lkml]   [2012]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 06/46] fuse: verify all ioctl retry iov elements
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.5-stable review patch. If anyone has any objections, please let me know.

    ------------------

    From: Zach Brown <zab@redhat.com>

    commit fb6ccff667712c46b4501b920ea73a326e49626a upstream.

    Commit 7572777eef78ebdee1ecb7c258c0ef94d35bad16 attempted to verify that
    the total iovec from the client doesn't overflow iov_length() but it
    only checked the first element. The iovec could still overflow by
    starting with a small element. The obvious fix is to check all the
    elements.

    The overflow case doesn't look dangerous to the kernel as the copy is
    limited by the length after the overflow. This fix restores the
    intention of returning an error instead of successfully copying less
    than the iovec represented.

    I found this by code inspection. I built it but don't have a test case.
    I'm cc:ing stable because the initial commit did as well.

    Signed-off-by: Zach Brown <zab@redhat.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/fuse/file.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/fuse/file.c
    +++ b/fs/fuse/file.c
    @@ -1700,7 +1700,7 @@ static int fuse_verify_ioctl_iov(struct
    size_t n;
    u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;

    - for (n = 0; n < count; n++) {
    + for (n = 0; n < count; n++, iov++) {
    if (iov->iov_len > (size_t) max)
    return -ENOMEM;
    max -= iov->iov_len;



    \
     
     \ /
      Last update: 2012-08-20 07:01    [W:0.029 / U:1.268 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site