diff options
| author | Csaba Henk <csaba@gluster.com> | 2009-06-29 03:26:53 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@suse.cz> | 2009-06-30 20:06:23 +0200 |
| commit | b4c458b3a23d76936e76678f2074b1528f129f7a (patch) | |
| tree | 5b256bf81066e41442fa776cb668156bb4d58804 /fs/fuse | |
| parent | 28d0325ce6e0a52f53d8af687e6427fee59004d3 (diff) | |
| download | linux-b4c458b3a23d76936e76678f2074b1528f129f7a.tar.gz linux-b4c458b3a23d76936e76678f2074b1528f129f7a.tar.bz2 linux-b4c458b3a23d76936e76678f2074b1528f129f7a.zip | |
fuse: fix return value of fuse_dev_write()
On 64 bit systems -- where sizeof(ssize_t) > sizeof(int) -- the following test
exposes a bug due to a non-careful return of an int or unsigned value:
implement a FUSE filesystem which sends an unsolicited notification to
the kernel with invalid opcode. The respective write to /dev/fuse
will return (1 << 32) - EINVAL with errno == 0 instead of -1 with
errno == EINVAL.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Diffstat (limited to 'fs/fuse')
| -rw-r--r-- | fs/fuse/dev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8fed2ed12f38..8a11a8c67c42 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -910,7 +910,7 @@ static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov, unsigned long nr_segs, loff_t pos) { int err; - unsigned nbytes = iov_length(iov, nr_segs); + size_t nbytes = iov_length(iov, nr_segs); struct fuse_req *req; struct fuse_out_header oh; struct fuse_copy_state cs; |