Chirantan Ekbote d61cd1dcab fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS ... commit 31070f6cce upstream. The ioctl encoding for this parameter is a long but the documentation says it should be an int and the kernel drivers expect it to be an int. If the fuse driver treats this as a long it might end up scribbling over the stack of a userspace process that only allocated enough space for an int. This was previously discussed in [1] and a patch for fuse was proposed in [2]. From what I can tell the patch in [2] was nacked in favor of adding new, "fixed" ioctls and using those from userspace. However there is still no "fixed" version of these ioctls and the fact is that it's sometimes infeasible to change all userspace to use the new one. Handling the ioctls specially in the fuse driver seems like the most pragmatic way for fuse servers to support them without causing crashes in userspace applications that call them. [1]: https://lore.kernel.org/linux-fsdevel/20131126200559.GH20559@hall.aurel32.net/T/ [2]: https://sourceforge.net/p/fuse/mailman/message/31771759/ Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Fixes: 59efec7b90 ("fuse: implement ioctl support") Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-22 09:32:10 +02:00
..
9p
adfs
affs	affs: fix a memory leak in affs_remount	2020-01-27 14:51:21 +01:00
afs	afs: afs_write_end() should change i_size under the right lock	2020-06-25 15:33:06 +02:00
autofs
befs
bfs
btrfs	btrfs: fix fatal extent_buffer readahead vs releasepage race	2020-07-16 08:17:27 +02:00
cachefiles	cachefiles: Fix race between read_waiter and read_copier involving op->to_do	2020-06-03 08:19:29 +02:00
ceph	ceph: fix double unlock in handle_cap_export()	2020-05-27 17:37:34 +02:00
cifs	cifs: update ctime and mtime during truncate	2020-07-16 08:17:23 +02:00
coda
configfs	configfs: fix config_item refcnt leak in configfs_rmdir()	2020-05-27 17:37:32 +02:00
cramfs
crypto
debugfs
devpts
dlm	dlm: remove BUG() before panic()	2020-06-25 15:32:56 +02:00
ecryptfs	ecryptfs: replace BUG_ON with error handling code	2020-02-28 16:38:59 +01:00
efivarfs
efs
exofs
exportfs	exportfs: fix 'passing zero to ERR_PTR()' warning	2020-01-27 14:50:02 +01:00
ext2	ext2: fix debug reference to ext2_xattr_cache	2020-04-23 10:30:21 +02:00
ext4	ext4: avoid race conditions when remounting with options that change dax	2020-06-25 15:33:07 +02:00
f2fs	f2fs: report delalloc reserve as non-free in statfs for project quota	2020-06-25 15:32:49 +02:00
fat	fat: don't allow to mount if the FAT length == 0	2020-06-22 09:05:08 +02:00
freevxfs
fscache
fuse	fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS	2020-07-22 09:32:10 +02:00
gfs2	gfs2: read-only mounts should grab the sd_freeze_gl glock	2020-07-22 09:32:01 +02:00
hfs
hfsplus	hfsplus: fix crash and filesystem corruption when deleting files	2020-04-17 10:48:52 +02:00
hostfs
hpfs
hugetlbfs
isofs
jbd2	jbd2: improve comments about freeing data buffers whose page mapping is NULL	2020-04-21 09:03:06 +02:00
jffs2
jfs	jfs: fix bogus variable self-initialization	2020-01-27 14:50:33 +01:00
kernfs
lockd
minix
nfs	NFSv4 fix CLOSE not waiting for direct IO compeletion	2020-06-30 23:17:18 -04:00
nfs_common
nfsd	nfsd: apply umask on fs without ACL support	2020-07-09 09:37:11 +02:00
nilfs2	nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()	2020-06-22 09:05:03 +02:00
nls
notify	fanotify: fix ignore mask logic for events on child and on dir	2020-06-30 23:17:00 -04:00
ntfs
ocfs2	ocfs2: fix panic on nfs server over ocfs2	2020-06-30 23:17:17 -04:00
omfs
openpromfs
orangefs	help_next should increase position index	2020-02-24 08:34:53 +01:00
overlayfs	ovl: fix unneeded call to ovl_change_flags()	2020-07-22 09:32:10 +02:00
proc	proc: Use new_inode not new_inode_pseudo	2020-06-22 09:05:06 +02:00
pstore	pstore: pstore_ftrace_seq_next should increase position index	2020-04-17 10:48:47 +02:00
qnx4
qnx6
quota
ramfs
reiserfs	reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()	2020-02-24 08:34:52 +01:00
romfs
squashfs
sysfs
sysv
tracefs
ubifs	ubifs: remove broken lazytime support	2020-05-27 17:37:30 +02:00
udf	udf: Fix free space reporting for metadata and virtual partitions	2020-02-24 08:34:45 +01:00
ufs
xfs	xfs: add agf freeblocks verify in xfs_agf_verify	2020-06-30 23:17:19 -04:00
aio.c	aio: fix async fsync creds	2020-06-22 09:05:01 +02:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:19:41 +02:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	block: Fix use-after-free in blkdev_get()	2020-06-25 15:33:06 +02:00
buffer.c	ext4: use non-movable memory for superblock readahead	2020-04-23 10:30:12 +02:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c	coredump: fix crash when umh is disabled	2020-05-14 07:57:21 +02:00
d_path.c
dax.c	dax: pass NOWAIT flag to iomap_apply	2020-03-05 16:42:12 +01:00
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c	eventfd: track eventfd_signal() recursion depth	2020-02-11 04:34:08 -08:00
eventpoll.c
exec.c	exec: Move would_dump into flush_old_exec	2020-05-20 08:18:50 +02:00
fcntl.c
fhandle.c
file_table.c
file.c	fix multiplication overflow in copy_fdtable()	2020-05-27 17:37:29 +02:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-17 10:48:51 +02:00
fs_pin.c
fs_struct.c
fs-writeback.c	cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages	2020-06-22 09:05:03 +02:00
inode.c	futex: Fix inode life-time issue	2020-03-25 08:06:14 +01:00
internal.h
ioctl.c
iomap.c
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix infoleak in simple_attr_read()	2020-04-02 15:28:21 +02:00
locks.c
Makefile
mbcache.c
mount.h
mpage.c
namei.c	namei: only return -ECHILD from follow_dotdot_rcu()	2020-03-05 16:42:20 +01:00
namespace.c	fs/namespace.c: fix mountpoint reference counter race	2020-04-29 16:31:26 +02:00
no-block.c
nsfs.c
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-18 07:14:21 +01:00
pipe.c
pnode.c	propagate_one(): mnt_set_mountpoint() needs mount_lock	2020-05-02 17:26:01 +02:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
userfaultfd.c
utimes.c
xattr.c