]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
fuse: handle zero sized retrieve correctly
authorMiklos Szeredi <mszeredi@redhat.com>
Wed, 16 Jan 2019 09:27:59 +0000 (10:27 +0100)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 23 Apr 2019 15:51:48 +0000 (17:51 +0200)
commit0118622a57a00597cce21a124fa636bd4afc3250
tree00434e979ce29f39ef6d69236d1579c0e044edf6
parent06cdde5d23f5ffdf9b692b44e90277662be682db
fuse: handle zero sized retrieve correctly

BugLink: https://bugs.launchpad.net/bugs/1824553
Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.

Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Fixes: b2430d7567a3 ("fuse: add per-page descriptor <offset, length> to fuse_req")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
(cherry picked from commit 97e1532ef81acb31c30f9e75bf00306c33a77812)
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
fs/fuse/dev.c