Re: [PATCH v3 2/2] fuse: bound io-uring payload copies to the registered buffer size

[Xiang Mei]

On Mon, Jul 13, 2026 at 10:24 AM Joanne Koong <joannelkoong@xxxxxxxxx> wrote:
>
> On Thu, Jul 9, 2026 at 2:11 PM Xiang Mei <xmei5@xxxxxxx> wrote:
> >
> > The fuse-io-uring transport imports each ring entry's payload buffer at
> > ring->max_payload_sz and bounds both copy directions against that value,
> > ignoring the buffer length the server actually registered.  Both the
> > server-supplied reply payload_sz (fuse_uring_copy_from_ring) and an
> > oversized request payload such as a large FUSE_SETXATTR value
> > (fuse_uring_args_to_ring) can then overrun the imported iterator and hit
> > fuse_copy_fill()'s BUG_ON(!err):
> >
> >   kernel BUG at fs/fuse/dev.c:1053!
> >   Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
> >   RIP: 0010:fuse_copy_fill (fs/fuse/dev.c:1022)
> >   Call Trace:
> >    fuse_copy_args (fs/fuse/dev.c:1329 fs/fuse/dev.c:1351)
> >    fuse_uring_copy_from_ring (fs/fuse/dev_uring.c:686)
> >    fuse_uring_cmd (fs/fuse/dev_uring.c:1226)
> >    io_uring_cmd (io_uring/uring_cmd.c:271)
> >    __io_issue_sqe (io_uring/io_uring.c:1395)
> >    io_issue_sqe (io_uring/io_uring.c:1418)
> >    io_submit_sqes (io_uring/io_uring.c:1649 io_uring/io_uring.c:1934 io_uring/io_uring.c:2057)
> >    __do_sys_io_uring_enter (io_uring/io_uring.c:2646)
> >    do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> >    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> >
> > The request path overruns the same way, via fuse_copy_args() ->
> > fuse_uring_args_to_ring().
> >
> > Store the registered payload length (payload->iov_len) in the ring entry
> > and use it for the import and both bounds checks, so the buffer the
> > server provided is honoured and an oversized reply/request is rejected
> > (-EINVAL for a reply, and -E2BIG/-EIO for a request, matching
> > fuse_dev_do_read()) instead of panicking.
> >
> > Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Reported-by: Weiming Shi <bestswngs@xxxxxxxxx>
> > Assisted-by: Claude:claude-opus-4-8
> > Signed-off-by: Xiang Mei <xmei5@xxxxxxx>
> > ---
> > v3: propose the patch fixing another issue found by Bernd by Joanne suggested way
> >
> >  fs/fuse/dev_uring.c   | 9 ++++++++-
> >  fs/fuse/dev_uring_i.h | 1 +
> >  2 files changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> > index 0814681eb04b..248e5a3e340e 100644
> > --- a/fs/fuse/dev_uring.c
> > +++ b/fs/fuse/dev_uring.c
> > @@ -650,7 +650,7 @@ static int setup_fuse_copy_state(struct fuse_copy_state *cs,
> >  {
> >         int err;
> >
> > -       err = import_ubuf(dir, ent->payload, ring->max_payload_sz, iter);
> > +       err = import_ubuf(dir, ent->payload, ent->payload_sz, iter);
> >         if (err) {
> >                 pr_info_ratelimited("fuse: Import of user buffer failed\n");
> >                 return err;
> > @@ -679,6 +679,9 @@ static int fuse_uring_copy_from_ring(struct fuse_ring *ring,
> >         if (err)
> >                 return err;
> >
> > +       if (ring_in_out.payload_sz > ent->payload_sz)
> > +               return -EINVAL;
> > +
> >         err = setup_fuse_copy_state(&cs, ring, req, ent, ITER_SOURCE, &iter);
> >         if (err)
> >                 return err;
> > @@ -725,6 +728,9 @@ static int fuse_uring_args_to_ring(struct fuse_ring *ring, struct fuse_req *req,
> >                 num_args--;
> >         }
> >
> > +       if (fuse_len_args(num_args, (struct fuse_arg *)in_args) > ent->payload_sz)
> > +               return args->opcode == FUSE_SETXATTR ? -E2BIG : -EIO;
>
> Reviewed-by: Joanne Koong <joannelkoong@xxxxxxxxx>
>
> Not saying you have to do this, but if you wanted to, I think it'd be
> nice to have a separate cleanup patch that deduplicates this setxattr
> special casing logic between the /dev/fuse path and here.
>
> Thanks,
> Joanne

Thanks for your review. I updated my 1/2 to make it an elegant patch
and added your suggested cleanup as 3/3.
1/3: drop previous tags; reserve the fields for user copy
https://lore.kernel.org/fuse-devel/20260714235408.1666063-1-xmei5@xxxxxxx/T/#t
2/3: no change
https://lore.kernel.org/fuse-devel/20260714235408.1666063-2-xmei5@xxxxxxx/T/#t
3/3: add a helper to return the correct error code
https://lore.kernel.org/fuse-devel/20260714235408.1666063-3-xmei5@xxxxxxx/T/#t

Xiang