Patch "fs/fuse: fix ioctl type confusion" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

fs/fuse: fix ioctl type confusion

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
fs-fuse-fix-ioctl-type-confusion.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jann Horn <[email protected]>
Date: Sun, 16 Aug 2015 20:27:01 +0200
Subject: fs/fuse: fix ioctl type confusion

From: Jann Horn <[email protected]>

commit 8ed1f0e22f49ef42e63875fd2529389a32ff3566 upstream.

fuse_dev_ioctl() performed fuse_get_dev() on a user-supplied fd, leading to a type confusion issue. Fix it by checking file->f_op.

index 80cc1b35d460..ebb5e37455a0 100644
@@ -2246,7 +2246,15 @@ static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
 
 			err = -EINVAL;
 			if (old) {
-				struct fuse_dev *fud = fuse_get_dev(old);
+				struct fuse_dev *fud = NULL;
+
+				/*
+				 * Check against file->f_op because CUSE
+				 * uses the same ioctl handler.
+				 */
+				if (old->f_op == file->f_op &&
+				    old->f_cred->user_ns == file->f_cred->user_ns)
+					fud = fuse_get_dev(old);
 
 				if (fud) {
 					mutex_lock(&fuse_mutex);

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/cifs-fix-type-confusion-in-copy-offload-ioctl.patch queue-4.1/fs-fuse-fix-ioctl-type-confusion.patch