Add a safety check to ensure that the length of data written by the device is at least as large the expected length. If this condition is not met, it indicates a potential error in the device's response.
This change aligns with the virtio specification, which states: "The driver MUST NOT make assumptions about data in device-writable buffers beyond the first len bytes, and SHOULD ignore this data." By setting an error status when len is insufficient, we ensure that the driver does not process potentially invalid or incomplete data from the device. Signed-off-by: Aurelien Aptel <[email protected]> Signed-off-by: Lokesh Arora <[email protected]> Signed-off-by: Max Gurtovoy <[email protected]> --- fs/fuse/virtio_fs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 82afe78ec542..658e51e41292 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -827,6 +827,15 @@ static void virtio_fs_requests_done_work(struct work_struct *work) virtqueue_disable_cb(vq); while ((req = virtqueue_get_buf(vq, &len)) != NULL) { + + /* + * Check device writable portion length, and fail upon + * error. + */ + if (unlikely(len < sizeof(req->out.h) || + len < req->out.h.len)) + req->out.h.error = -EIO; + spin_lock(&fpq->lock); list_move_tail(&req->list, &reqs); spin_unlock(&fpq->lock); -- 2.18.1
