From 902adc7150f2f77f601cbfee96d5d55b77925503 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@suse.cz>
Date: Tue, 30 Nov 2010 16:39:27 +0100
Subject: [PATCH] --- yaml --- r: 223065 b: refs/heads/master c:
 7572777eef78ebdee1ecb7c258c0ef94d35bad16 h: refs/heads/master i:   223063:
 43676b78cbf3ba098054932aacef0b51c68df47d v: v3

---
 [refs]               |  2 +-
 trunk/fs/fuse/file.c | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index c798429cf454..abbaef768fb8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d9d318d39dd5cb686660504a3565aac453709ccc
+refs/heads/master: 7572777eef78ebdee1ecb7c258c0ef94d35bad16
diff --git a/trunk/fs/fuse/file.c b/trunk/fs/fuse/file.c
index 0e2e25b114a6..8b984a2cebbd 100644
--- a/trunk/fs/fuse/file.c
+++ b/trunk/fs/fuse/file.c
@@ -1666,6 +1666,20 @@ static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
 	return 0;
 }
 
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+	size_t n;
+	u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+	for (n = 0; n < count; n++) {
+		if (iov->iov_len > (size_t) max)
+			return -ENOMEM;
+		max -= iov->iov_len;
+	}
+	return 0;
+}
+
 /*
  * For ioctls, there is no generic way to determine how much memory
  * needs to be read and/or written.  Furthermore, ioctls are allowed
@@ -1858,6 +1872,14 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 		in_iov = page_address(iov_page);
 		out_iov = in_iov + in_iovs;
 
+		err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+		if (err)
+			goto out;
+
+		err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+		if (err)
+			goto out;
+
 		goto retry;
 	}