This is a note to let you know that I've just added the patch titled
fuse: verify ioctl retries
to the 2.6.36-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fuse-verify-ioctl-retries.patch
and it can be found in the queue-2.6.36 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 7572777eef78ebdee1ecb7c258c0ef94d35bad16 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <[email protected]>
Date: Tue, 30 Nov 2010 16:39:27 +0100
Subject: fuse: verify ioctl retries
From: Miklos Szeredi <[email protected]>
commit 7572777eef78ebdee1ecb7c258c0ef94d35bad16 upstream.
Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY
doesn't overflow iov_length().
Signed-off-by: Miklos Szeredi <[email protected]>
CC: Tejun Heo <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/fuse/file.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1627,6 +1627,20 @@ static int fuse_ioctl_copy_user(struct p
return 0;
}
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+ size_t n;
+ u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+ for (n = 0; n < count; n++) {
+ if (iov->iov_len > (size_t) max)
+ return -ENOMEM;
+ max -= iov->iov_len;
+ }
+ return 0;
+}
+
/*
* For ioctls, there is no generic way to determine how much memory
* needs to be read and/or written. Furthermore, ioctls are allowed
@@ -1820,6 +1834,14 @@ long fuse_do_ioctl(struct file *file, un
in_iov = page_address(iov_page);
out_iov = in_iov + in_iovs;
+ err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+ if (err)
+ goto out;
+
+ err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+ if (err)
+ goto out;
+
goto retry;
}
Patches currently in stable-queue which might be from [email protected] are
queue-2.6.36/fuse-verify-ioctl-retries.patch
queue-2.6.36/fuse-fix-ioctl-when-server-is-32bit.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
