linux/fs/fuse
Zach Brown fb6ccff667 fuse: verify all ioctl retry iov elements
Commit 7572777eef attempted to verify that
the total iovec from the client doesn't overflow iov_length() but it
only checked the first element.  The iovec could still overflow by
starting with a small element.  The obvious fix is to check all the
elements.

The overflow case doesn't look dangerous to the kernel as the copy is
limited by the length after the overflow.  This fix restores the
intention of returning an error instead of successfully copying less
than the iovec represented.

I found this by code inspection.  I built it but don't have a test case.
I'm cc:ing stable because the initial commit did as well.

Signed-off-by: Zach Brown <zab@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: <stable@vger.kernel.org>         [2.6.37+]
2012-08-06 18:19:24 +02:00
..
control.c fuse: Convert to kstrtoul_from_user 2012-04-25 12:25:05 +02:00
cuse.c fs: add module.h to files that were implicitly using it 2011-10-31 19:30:31 -04:00
dev.c fuse: remove the second argument of k[un]map_atomic() 2012-03-20 21:48:22 +08:00
dir.c fuse: fix blksize calculation 2012-05-14 17:12:56 +02:00
file.c fuse: verify all ioctl retry iov elements 2012-08-06 18:19:24 +02:00
fuse_i.h fuse: add FUSE_AUTO_INVAL_DATA init flag 2012-07-18 16:09:40 +02:00
inode.c fuse: add missing INIT flags 2012-07-18 16:09:40 +02:00
Kconfig fs/Kconfig: move fuse out 2009-01-22 13:15:55 +03:00
Makefile CUSE: implement CUSE - Character device in Userspace 2009-06-09 11:24:11 +02:00