Re: [PATCH 2/2] fuse: reject oversized payload_sz in fuse_uring_copy_from_ring()

On Mon, Jul 6, 2026 at 2:29 PM Joanne Koong <[email protected]> wrote:
>
> On Mon, Jul 6, 2026 at 12:13 PM Xiang Mei <[email protected]> wrote:
> >
> > fuse_uring_copy_from_ring() imports the payload buffer with length
> > ring->max_payload_sz but passes the server-controlled payload_sz to
> > fuse_copy_out_args() unchecked.  A larger payload_sz drains the iterator
> > to exhaustion and fuse_copy_fill() hits BUG_ON(!err), panicking the
> > kernel.  Reject replies whose payload_sz exceeds the imported buffer.
> >
> >   kernel BUG at fs/fuse/dev.c:1053!
> >   RIP: 0010:fuse_copy_fill+0x6c6/0x7e0
> >   Call Trace:
> >    fuse_copy_args
> >    fuse_uring_copy_from_ring     fs/fuse/dev_uring.c:686
> >    fuse_uring_cmd
> >    io_uring_cmd
> >    __io_issue_sqe
> >    io_submit_sqes
> >    __do_sys_io_uring_enter
> >    entry_SYSCALL_64_after_hwframe
> >
> > Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
> > Reported-by: Weiming Shi <[email protected]>
> > Assisted-by: Claude:claude-opus-4-8
> > Signed-off-by: Xiang Mei <[email protected]>
> > ---
> >  fs/fuse/dev_uring.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> > index 0814681eb04b..f6127c230dd9 100644
> > --- a/fs/fuse/dev_uring.c
> > +++ b/fs/fuse/dev_uring.c
> > @@ -679,6 +679,9 @@ static int fuse_uring_copy_from_ring(struct fuse_ring *ring,
> >         if (err)
> >                 return err;
> >
> > +       if (ring_in_out.payload_sz > ring->max_payload_sz)
> > +               return -EINVAL;
> > +
> >         err = setup_fuse_copy_state(&cs, ring, req, ent, ITER_SOURCE, &iter);
> >         if (err)
> >                 return err;
> > --
> > 2.43.0
> >
>
> Makes sense to me. Thanks for including the stack trace in the commit message.
>
> Reviewed-by: Joanne Koong <[email protected]>
>
> Same comment about stable@ as in the other patch - not sure if the
> commit message has to explicitly include the tag.
>
Thanks for your review. To ensure it's backported, I'll send a v2 with
cc'ing stable.

Xiang
> Thanks,
> Joanne