Zach Brown 90f9cb724d fuse: verify all ioctl retry iov elements ... commit fb6ccff667 upstream. Commit 7572777eef attempted to verify that the total iovec from the client doesn't overflow iov_length() but it only checked the first element. The iovec could still overflow by starting with a small element. The obvious fix is to check all the elements. The overflow case doesn't look dangerous to the kernel as the copy is limited by the length after the overflow. This fix restores the intention of returning an error instead of successfully copying less than the iovec represented. I found this by code inspection. I built it but don't have a test case. I'm cc:ing stable because the initial commit did as well. Signed-off-by: Zach Brown <zab@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-08-26 15:00:39 -07:00
..
control.c	filesystems: add set_nlink()	2011-11-02 12:53:43 +01:00
cuse.c	fs: add module.h to files that were implicitly using it	2011-10-31 19:30:31 -04:00
dev.c	fuse: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:22 +08:00
dir.c	fuse: fix stat call on 32 bit platforms	2012-06-17 11:21:29 -07:00
file.c	fuse: verify all ioctl retry iov elements	2012-08-26 15:00:39 -07:00
fuse_i.h	fuse: fix stat call on 32 bit platforms	2012-06-17 11:21:29 -07:00
inode.c	fuse: fix stat call on 32 bit platforms	2012-06-17 11:21:29 -07:00
Kconfig	fs/Kconfig: move fuse out	2009-01-22 13:15:55 +03:00
Makefile	CUSE: implement CUSE - Character device in Userspace	2009-06-09 11:24:11 +02:00