diff options
| author | Edward Adam Davis <eadavis@qq.com> | 2025-08-27 09:45:55 +0800 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2025-08-27 14:29:43 +0200 |
| commit | 9d81ba6d49a7457784f0b6a71046818b86ec7e44 (patch) | |
| tree | 28f6865b462c86cf632ef866aa7338e562c0cff0 /tools/perf/scripts/python/libxed.py | |
| parent | bd24d2108e9c8459d2c9f3d6d910b0053887df57 (diff) | |
fuse: Block access to folio overlimit
syz reported a slab-out-of-bounds Write in fuse_dev_do_write.
When the number of bytes to be retrieved is truncated to the upper limit
by fc->max_pages and there is an offset, the oob is triggered.
Add a loop termination condition to prevent overruns.
Fixes: 3568a9569326 ("fuse: support large folios for retrieves")
Reported-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2d215d165f9354b9c4ea
Tested-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'tools/perf/scripts/python/libxed.py')
0 files changed, 0 insertions, 0 deletions