mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
fuse: handle zero sized retrieve correctly
Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.
Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Fixes: b2430d7567
("fuse: add per-page descriptor <offset, length> to fuse_req")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
parent
bfeffd1552
commit
97e1532ef8
1 changed files with 1 additions and 1 deletions
|
@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
|
|||
req->in.h.nodeid = outarg->nodeid;
|
||||
req->in.numargs = 2;
|
||||
req->in.argpages = 1;
|
||||
req->page_descs[0].offset = offset;
|
||||
req->end = fuse_retrieve_end;
|
||||
|
||||
index = outarg->offset >> PAGE_SHIFT;
|
||||
|
@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
|
|||
|
||||
this_num = min_t(unsigned, num, PAGE_SIZE - offset);
|
||||
req->pages[req->num_pages] = page;
|
||||
req->page_descs[req->num_pages].offset = offset;
|
||||
req->page_descs[req->num_pages].length = this_num;
|
||||
req->num_pages++;
|
||||
|
||||
|
|
Loading…
Reference in a new issue