From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Miklos Szeredi <mszeredi@suse.cz>
Subject: [patch 23/24] fuse: fix return value of fuse_dev_write()
Date: Fri, 17 Jul 2009 13:09:14 -0700 [thread overview]
Message-ID: <20090717201237.955389551@mini.kroah.org> (raw)
In-Reply-To: <20090717201639.GA14209@kroah.com>
[-- Attachment #1: fuse-fix-return-value-of-fuse_dev_write.patch --]
[-- Type: text/plain, Size: 1082 bytes --]
2.6.30-stable review patch. If anyone has any objections, please let us know.
------------------
From: Csaba Henk <csaba@gluster.com>
commit b4c458b3a23d76936e76678f2074b1528f129f7a upstream.
On 64 bit systems -- where sizeof(ssize_t) > sizeof(int) -- the following test
exposes a bug due to a non-careful return of an int or unsigned value:
implement a FUSE filesystem which sends an unsolicited notification to
the kernel with invalid opcode. The respective write to /dev/fuse
will return (1 << 32) - EINVAL with errno == 0 instead of -1 with
errno == EINVAL.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/fuse/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -904,7 +904,7 @@ static ssize_t fuse_dev_write(struct kio
unsigned long nr_segs, loff_t pos)
{
int err;
- unsigned nbytes = iov_length(iov, nr_segs);
+ size_t nbytes = iov_length(iov, nr_segs);
struct fuse_req *req;
struct fuse_out_header oh;
struct fuse_copy_state cs;
next prev parent reply other threads:[~2009-07-17 20:20 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20090717200851.907421303@mini.kroah.org>
2009-07-17 20:16 ` [patch 00/24] 2.6.30.2-stable review Greg KH
2009-07-17 20:08 ` [patch 01/24] Add -fno-delete-null-pointer-checks to gcc CFLAGS Greg KH
2009-07-17 20:08 ` [patch 02/24] security: use mmap_min_addr indepedently of security models Greg KH
2009-07-17 20:08 ` [patch 03/24] tun/tap: Fix crashes if open() /dev/net/tun and then poll() it. (CVE-2009-1897) Greg KH
2009-07-17 20:08 ` [patch 04/24] personality: fix PER_CLEAR_ON_SETID (CVE-2009-1895) Greg KH
2009-07-17 20:08 ` [patch 05/24] Blackfin: fix accidental reset in some boot modes Greg KH
2009-07-17 20:08 ` [patch 06/24] Blackfin: redo handling of bad irqs Greg KH
2009-07-17 20:08 ` [patch 07/24] Blackfin: fix deadlock in SMP IPI handler Greg KH
2009-07-17 20:08 ` [patch 08/24] Blackfin: fix command line corruption with DEBUG_DOUBLEFAULT Greg KH
2009-07-17 20:09 ` [patch 09/24] futex: Fix the write access fault problem for real Greg KH
2009-07-17 20:09 ` [patch 10/24] futexes: Fix infinite loop in get_futex_key() on huge page Greg KH
2009-07-17 20:09 ` [patch 11/24] kernel/resource.c: fix sign extension in reserve_setup() Greg KH
2009-07-17 20:09 ` [patch 12/24] alpha: fix percpu build breakage Greg KH
2009-07-17 20:09 ` [patch 13/24] dma-debug: fix off-by-one error in overlap function Greg KH
2009-07-17 20:09 ` [patch 14/24] blocK: Restore barrier support for md and probably other virtual devices Greg KH
2009-07-17 20:09 ` [patch 15/24] md/raid5: suspend shouldnt affect read requests Greg KH
2009-07-17 20:09 ` [patch 16/24] md: fix error path when duplicate name is found on md device creation Greg KH
2009-07-17 20:09 ` [patch 17/24] md: avoid dereferencing NULL pointer when accessing suspend_* sysfs attributes Greg KH
2009-07-17 20:09 ` [patch 18/24] Revert "ipv4: arp announce, arp_proxy and windows ip conflict verification" Greg KH
2009-07-17 20:09 ` [patch 19/24] floppy: fix lock imbalance Greg KH
2009-07-17 20:09 ` [patch 20/24] Fix pci_unmap_addr() et al on i386 Greg KH
2009-07-17 20:09 ` [patch 21/24] Fix iommu address space allocation Greg KH
2009-07-17 20:09 ` [patch 22/24] fuse: fix bad return value in fuse_file_poll() Greg KH
2009-07-17 20:09 ` Greg KH [this message]
2009-07-17 20:09 ` [patch 24/24] Dont use -fwrapv compiler option: its buggy in gcc-4.1.x Greg KH
2009-07-17 20:36 ` [patch 00/24] 2.6.30.2-stable review Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090717201237.955389551@mini.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=mszeredi@suse.cz \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.