Add a safety check to ensure that the length of data written by the
device is at least as large the expected length. If this condition is
not met, it indicates a potential error in the device's response.
This change aligns with the virtio specification, which states:
"The driver MUST NOT make assumptions about data in device-writable
buffers beyond the first len bytes, and SHOULD ignore this data."
By setting an error status when len is insufficient, we ensure that
the driver does not process potentially invalid or incomplete data from
the device.
Signed-off-by: Aurelien Aptel <aaptel@xxxxxxxxxx>
Signed-off-by: Lokesh Arora <larora@xxxxxxxxxx>
Signed-off-by: Max Gurtovoy <mgurtovoy@xxxxxxxxxx>
---
fs/fuse/virtio_fs.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 82afe78ec542..658e51e41292 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -827,6 +827,15 @@ static void virtio_fs_requests_done_work(struct work_struct *work)
virtqueue_disable_cb(vq);
while ((req = virtqueue_get_buf(vq, &len)) != NULL) {
+
+ /*
+ * Check device writable portion length, and fail upon
+ * error.
+ */
+ if (unlikely(len < sizeof(req->out.h) ||
+ len < req->out.h.len))
+ req->out.h.error = -EIO;
+
spin_lock(&fpq->lock);
list_move_tail(&req->list, &reqs);
spin_unlock(&fpq->lock);
--
2.18.1
