Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-02-12 22:18:26 +0100
committerJiri Slaby <jslaby@suse.cz>2019-02-12 22:21:19 +0100
commit14f66f54ae367948d8167423e7407429ea0a6826 (patch)
treeb9f09d5f6166eaa7a4a0b766110aefbd9e76a5f8
parent0adae2c09192fd1442cdf33421e1000221da591e (diff)
fuse: handle zero sized retrieve correctly (bnc#1012628).
-rw-r--r--patches.kernel.org/4.20.8-313-fuse-handle-zero-sized-retrieve-correctly.patch45
-rw-r--r--series.conf1
2 files changed, 46 insertions, 0 deletions
diff --git a/patches.kernel.org/4.20.8-313-fuse-handle-zero-sized-retrieve-correctly.patch b/patches.kernel.org/4.20.8-313-fuse-handle-zero-sized-retrieve-correctly.patch
new file mode 100644
index 0000000000..184618195c
--- /dev/null
+++ b/patches.kernel.org/4.20.8-313-fuse-handle-zero-sized-retrieve-correctly.patch
@@ -0,0 +1,45 @@
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 16 Jan 2019 10:27:59 +0100
+Subject: [PATCH] fuse: handle zero sized retrieve correctly
+References: bnc#1012628
+Patch-mainline: 4.20.8
+Git-commit: 97e1532ef81acb31c30f9e75bf00306c33a77812
+
+commit 97e1532ef81acb31c30f9e75bf00306c33a77812 upstream.
+
+Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.
+
+Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
+Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
+Fixes: b2430d7567a3 ("fuse: add per-page descriptor <offset, length> to fuse_req")
+Cc: <stable@vger.kernel.org> # v3.9
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/fuse/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index ef00a8277824..809c0f2f9942 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+ req->in.h.nodeid = outarg->nodeid;
+ req->in.numargs = 2;
+ req->in.argpages = 1;
+- req->page_descs[0].offset = offset;
+ req->end = fuse_retrieve_end;
+
+ index = outarg->offset >> PAGE_SHIFT;
+@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+
+ this_num = min_t(unsigned, num, PAGE_SIZE - offset);
+ req->pages[req->num_pages] = page;
++ req->page_descs[req->num_pages].offset = offset;
+ req->page_descs[req->num_pages].length = this_num;
+ req->num_pages++;
+
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index df5365762e..f759f5f141 100644
--- a/series.conf
+++ b/series.conf
@@ -1049,6 +1049,7 @@
patches.kernel.org/4.20.8-310-ALSA-hda-realtek-Headset-microphone-support-fo.patch
patches.kernel.org/4.20.8-311-fuse-call-pipe_buf_release-under-pipe-lock.patch
patches.kernel.org/4.20.8-312-fuse-decrement-NR_WRITEBACK_TEMP-on-the-right-.patch
+ patches.kernel.org/4.20.8-313-fuse-handle-zero-sized-retrieve-correctly.patch
########################################################
# Build fixes that apply to the vanilla kernel too.