Unverified Commit 51a8de6c authored by Samuel Page's avatar Samuel Page Committed by Christian Brauner
Browse files

fuse: reject oversized dirents in page cache 



fuse_add_dirent_to_cache() computes a serialized dirent size from the
server-controlled namelen field and copies the dirent into a single
page-cache page. The existing logic only checks whether the dirent fits
in the remaining space of the current page and advances to a fresh page
if not. It never checks whether the dirent itself exceeds PAGE_SIZE.

As a result, a malicious FUSE server can return a dirent with
namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB
page systems this causes memcpy() to overflow the cache page by 24 bytes
into the following kernel page.

Reject dirents that cannot fit in a single page before copying them into
the readdir cache.

Fixes: 69e34551 ("fuse: allow caching readdir")
Cc: stable@vger.kernel.org # v6.16+
Assisted-by: Bynario AI
Signed-off-by: default avatarSamuel Page <sam@bynar.io>
Reported-by: default avatarQi Tang <tpluszz77@gmail.com>
Reported-by: default avatarZijun Hu <nightu@northwestern.edu>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Link: https://patch.msgid.link/20260420090139.662772-1-mszeredi@redhat.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 6689f01d

fs/fuse/readdir.c

+4 −0
Original line number Diff line number Diff line
@@ -41,6 +41,10 @@ static void fuse_add_dirent_to_cache(struct file *file, 
	unsigned int offset;

	void *addr;



	/* Dirent doesn't fit in readdir cache page?  Skip caching. */

	if (reclen > PAGE_SIZE)

		return;



	spin_lock(&fi->rdc.lock);

	/*

	 * Is cache already completed?  Or this entry does not go at the end of