fuse: handle zero sized retrieve correctly (97e1532e) · Commits · 戴 / test

Dereferencing req->page_descs[0] will Oops if req->max_pages is zero. Reported-by:

<syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com> Fixes: ("fuse: add per-page descriptor <offset, length> to fuse_req") Cc: <stable@vger.kernel.org> # v3.9 Signed-off-by:

fs/fuse/dev.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn fc, struct inode inode,
		req->in.h.nodeid = outarg->nodeid;
		req->in.numargs = 2;
		req->in.argpages = 1;
		req->page_descs[0].offset = offset;
		req->end = fuse_retrieve_end;

		index = outarg->offset >> PAGE_SHIFT;
		@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn fc, struct inode inode,

		this_num = min_t(unsigned, num, PAGE_SIZE - offset);
		req->pages[req->num_pages] = page;
		req->page_descs[req->num_pages].offset = offset;
		req->page_descs[req->num_pages].length = this_num;
		req->num_pages++;