mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 10:57:46 +00:00
fuse: verify ioctl retries
Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY doesn't overflow iov_length(). Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: Tejun Heo <tj@kernel.org> CC: <stable@kernel.org> [2.6.31+]
This commit is contained in:
parent
d9d318d39d
commit
7572777eef
1 changed files with 22 additions and 0 deletions
|
@ -1666,6 +1666,20 @@ static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* Make sure iov_length() won't overflow */
|
||||||
|
static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
|
||||||
|
{
|
||||||
|
size_t n;
|
||||||
|
u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
|
||||||
|
|
||||||
|
for (n = 0; n < count; n++) {
|
||||||
|
if (iov->iov_len > (size_t) max)
|
||||||
|
return -ENOMEM;
|
||||||
|
max -= iov->iov_len;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* For ioctls, there is no generic way to determine how much memory
|
* For ioctls, there is no generic way to determine how much memory
|
||||||
* needs to be read and/or written. Furthermore, ioctls are allowed
|
* needs to be read and/or written. Furthermore, ioctls are allowed
|
||||||
|
@ -1858,6 +1872,14 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
|
||||||
in_iov = page_address(iov_page);
|
in_iov = page_address(iov_page);
|
||||||
out_iov = in_iov + in_iovs;
|
out_iov = in_iov + in_iovs;
|
||||||
|
|
||||||
|
err = fuse_verify_ioctl_iov(in_iov, in_iovs);
|
||||||
|
if (err)
|
||||||
|
goto out;
|
||||||
|
|
||||||
|
err = fuse_verify_ioctl_iov(out_iov, out_iovs);
|
||||||
|
if (err)
|
||||||
|
goto out;
|
||||||
|
|
||||||
goto retry;
|
goto retry;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue