Re: [syzbot] [fuse?] KASAN: slab-out-of-bounds Write in fuse_dev_do_write

[Joanne Koong]

On Fri, Aug 22, 2025 at 5:55 PM syzbot
<syzbot+2d215d165f9354b9c4ea@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> failed to apply patch:
> checking file fs/fuse/dev.c
> patch: **** unexpected end of file in patch
>
>
>
> Tested on:
>
> commit:         cf6fc5ee Merge tag 's390-6.17-3' of git://git.kernel.o..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> kernel config:  https://syzkaller.appspot.com/x/.config?x=b7511150b112b9c3
> dashboard link: https://syzkaller.appspot.com/bug?extid=2d215d165f9354b9c4ea
> compiler:
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=116eaa34580000
>

#syz test: upstream cf6fc5eefc5bbbbff92a085039ff74cdbd065c29

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e80cd8f2c049..e84e05de9cdb 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1893,7 +1893,7 @@ static int fuse_retrieve(struct fuse_mount *fm,
struct inode *inode,

        index = outarg->offset >> PAGE_SHIFT;

-       while (num) {
+       while (num && num_pages) {
                struct folio *folio;
                unsigned int folio_offset;
                unsigned int nr_bytes;
@@ -1914,6 +1914,7 @@ static int fuse_retrieve(struct fuse_mount *fm,
struct inode *inode,

                offset = 0;
                num -= nr_bytes;
+               num_pages -= nr_pages;
                total_len += nr_bytes;
                index += nr_pages;
        }
--
2.47.3