> copy_args_to_argbuf() allocates one buffer for the fixed in- and out-args
> and fills only the in-arg part. The remainder is handed to the server as
> a device-writable buffer, and the server is under no obligation to write
> it: the used length it reports is its own claim and
> virtio_fs_verify_response() has nothing to cross-check it against.
>
> A reply that declares its full length without filling the buffer makes
> copy_args_from_argbuf() copy the uninitialized remainder to the caller,
> so a server that fails partway through writing a reply returns stale heap
> contents from e.g. fuse_statfs() or fuse_getxattr() instead of an error.
>
> Commit 5364d081125a ("virtiofs: validate fixed-output response length")
> covers the case where the declared length is short. Zero the reply
> region so that the remaining case yields zeroes rather than whatever the
> allocator last held. Only that region is zeroed; the in-arg part is
> overwritten by the copy below and the buffer can be as large as
> XATTR_SIZE_MAX.
>
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/bug/linux-f0d6d4a3-f5df-4f72-ab09-802e5aab49a6
> Signed-off-by: Miklos Szeredi <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=3
