Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97e1532e authored by Miklos Szeredi's avatar Miklos Szeredi
Browse files

fuse: handle zero sized retrieve correctly 



Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.

Reported-by: default avatar <syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com>
Fixes: b2430d75 ("fuse: add per-page descriptor <offset, length> to fuse_req")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent bfeffd15

fs/fuse/dev.c

+1 −1
Original line number Diff line number Diff line
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, 
	req->in.h.nodeid = outarg->nodeid;

	req->in.numargs = 2;

	req->in.argpages = 1;

	req->page_descs[0].offset = offset;

	req->end = fuse_retrieve_end;



	index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, 


		this_num = min_t(unsigned, num, PAGE_SIZE - offset);

		req->pages[req->num_pages] = page;

		req->page_descs[req->num_pages].offset = offset;

		req->page_descs[req->num_pages].length = this_num;

		req->num_pages++;