Re: [PATCH 2/2] fuse: reject oversized payload_sz in fuse_uring_copy_from_ring()

On Mon, Jul 6, 2026 at 12:13 PM Xiang Mei <[email protected]> wrote:
>
> fuse_uring_copy_from_ring() imports the payload buffer with length
> ring->max_payload_sz but passes the server-controlled payload_sz to
> fuse_copy_out_args() unchecked.  A larger payload_sz drains the iterator
> to exhaustion and fuse_copy_fill() hits BUG_ON(!err), panicking the
> kernel.  Reject replies whose payload_sz exceeds the imported buffer.
>
>   kernel BUG at fs/fuse/dev.c:1053!
>   RIP: 0010:fuse_copy_fill+0x6c6/0x7e0
>   Call Trace:
>    fuse_copy_args
>    fuse_uring_copy_from_ring     fs/fuse/dev_uring.c:686
>    fuse_uring_cmd
>    io_uring_cmd
>    __io_issue_sqe
>    io_submit_sqes
>    __do_sys_io_uring_enter
>    entry_SYSCALL_64_after_hwframe
>
> Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
> Reported-by: Weiming Shi <[email protected]>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Xiang Mei <[email protected]>
> ---
>  fs/fuse/dev_uring.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index 0814681eb04b..f6127c230dd9 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -679,6 +679,9 @@ static int fuse_uring_copy_from_ring(struct fuse_ring *ring,
>         if (err)
>                 return err;
>
> +       if (ring_in_out.payload_sz > ring->max_payload_sz)
> +               return -EINVAL;
> +
>         err = setup_fuse_copy_state(&cs, ring, req, ent, ITER_SOURCE, &iter);
>         if (err)
>                 return err;
> --
> 2.43.0
>

Makes sense to me. Thanks for including the stack trace in the commit message.

Reviewed-by: Joanne Koong <[email protected]>

Same comment about stable@ as in the other patch - not sure if the
commit message has to explicitly include the tag.

Thanks,
Joanne