diff mbox series

[2/2] virtio_fs: add length check for device writable portion

Message ID 20250224233106.8519-3-mgurtovoy@nvidia.com (mailing list archive)
State New
Headers show
Series virtio: Add length checks for device writable portions | expand

Commit Message

Max Gurtovoy Feb. 24, 2025, 11:31 p.m. UTC 
Add a safety check to ensure that the length of data written by the
device is at least as large the expected length. If this condition is
not met, it indicates a potential error in the device's response.

This change aligns with the virtio specification, which states:
"The driver MUST NOT make assumptions about data in device-writable
buffers beyond the first len bytes, and SHOULD ignore this data."

By setting an error status when len is insufficient, we ensure that
the driver does not process potentially invalid or incomplete data from
the device.

Signed-off-by: Aurelien Aptel <aaptel@nvidia.com>
Signed-off-by: Lokesh Arora <larora@nvidia.com>
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
---
 fs/fuse/virtio_fs.c | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 82afe78ec542..658e51e41292 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -827,6 +827,15 @@  static void virtio_fs_requests_done_work(struct work_struct *work)
 		virtqueue_disable_cb(vq);
 
 		while ((req = virtqueue_get_buf(vq, &len)) != NULL) {
+
+			/*
+			 * Check device writable portion length, and fail upon
+			 * error.
+			 */
+			if (unlikely(len < sizeof(req->out.h) ||
+			    len < req->out.h.len))
+				req->out.h.error = -EIO;
+
 			spin_lock(&fpq->lock);
 			list_move_tail(&req->list, &reqs);
 			spin_unlock(&fpq->lock);