Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5bfffac authored by Timo Savola's avatar Timo Savola Committed by Linus Torvalds
Browse files

[PATCH] fuse: validate rootmode mount option 



If rootmode isn't valid, we hit the BUG() in fuse_init_inode.  Now
EINVAL is returned.

Signed-off-by: default avatarTimo Savola <tsavola@movial.fi>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d354d2f4

fs/fuse/dir.c

+3 −2
Original line number Diff line number Diff line
@@ -195,7 +195,7 @@ static struct dentry_operations fuse_dentry_operations = { 
	.d_revalidate	= fuse_dentry_revalidate,

};



static int valid_mode(int m)

int fuse_valid_type(int m)

{

	return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||

		S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
@@ -248,7 +248,8 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry, 
	fuse_put_request(fc, req);

	/* Zero nodeid is same as -ENOENT, but with valid timeout */

	if (!err && outarg.nodeid &&

	    (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))

	    (invalid_nodeid(outarg.nodeid) ||

	     !fuse_valid_type(outarg.attr.mode)))

		err = -EIO;

	if (!err && outarg.nodeid) {

		inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,

fs/fuse/fuse_i.h

+5 −0
Original line number Diff line number Diff line
@@ -552,3 +552,8 @@ int fuse_ctl_add_conn(struct fuse_conn *fc); 
 * Remove connection from control filesystem

 */

void fuse_ctl_remove_conn(struct fuse_conn *fc);



/**

 * Is file type valid?

 */

int fuse_valid_type(int m);

fs/fuse/inode.c

+2 −0
Original line number Diff line number Diff line
@@ -330,6 +330,8 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) 
		case OPT_ROOTMODE:

			if (match_octal(&args[0], &value))

				return 0;

			if (!fuse_valid_type(value))

				return 0;

			d->rootmode = value;

			d->rootmode_present = 1;

			break;