github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

virtiofs: validate fixed-output response length

Browse Source 
A short successful virtiofs response can leave the fixed-output portion of
the request argument buffer unwritten.  The completion path nevertheless
copies the full declared output to the request destination, allowing stale
allocator contents to reach callers such as fuse_statfs().

Require successful fixed-output responses to contain their complete
declared output.  Continue to permit a shorter final argument only for
out_argvar requests.  Reject positive and internal restart error values
and require valid error replies to be header-only.  The error already
stored in the FUSE output header is returned by fuse_request_end(), so do
not copy output arguments from an error reply.

This was found by source review with AI assistance.  A header-only
successful FUSE_STATFS reply returned stale fields in nine of nine calls
across three boots.  The fixed kernel rejected the short response and
preserved complete replies, valid negative-error replies, and
variable-output replies.

Fixes: a62a8ef9d9 ("virtio-fs: add virtiofs filesystem")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
Sung Byeongchan 2026-10-07 15:19:49 +09:00 committed by Miklos Szeredi
parent ed6f750f98
commit 5364d08112
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
fs/fuse/virtio_fs.c
View File

@ -727,6 +727,10 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
unsigned int num_out;
unsigned int i;
/* fuse_request_end() returns this error; there are no args to copy. */
if (req->out.h.error)
goto out;
remaining = req->out.h.len - sizeof(req->out.h);
num_in = args->in_numargs - args->in_pages;
num_out = args->out_numargs - args->out_pages;
@ -752,6 +756,7 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
if (args->out_argvar)
args->out_args[args->out_numargs - 1].size = remaining;
out:
kfree(req->argbuf);
req->argbuf = NULL;
}
@ -759,7 +764,9 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
/* Verify that the server properly follows the FUSE protocol */
static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
{
struct fuse_args *args = req->args;
struct fuse_out_header *oh = &req->out.h;
unsigned int expected;
if (len < sizeof(*oh)) {
pr_warn("virtio-fs: response too short (%u)\n", len);
@ -774,6 +781,29 @@ static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
oh->unique, req->in.h.unique);
return false;
}
if (oh->error <= -ERESTARTSYS || oh->error > 0) {
pr_warn("virtio-fs: invalid error value (%d)\n", oh->error);
return false;
}
if (oh->error) {
if (len != sizeof(*oh)) {
pr_warn("virtio-fs: error response too long (%u)\n", len);
return false;
}
return true;
}
expected = sizeof(*oh) +
fuse_len_args(args->out_numargs, args->out_args);
if (len > expected ||
(len < expected &&
(!args->out_argvar ||
expected - len > args->out_args[args->out_numargs - 1].size))) {
pr_warn("virtio-fs: invalid response length (%u, expected %u)\n",
len, expected);
return false;
}
return true;
}