]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
fuse: validate outarg offset and size in notify store/retrieve
authorJoanne Koong <joannelkoong@gmail.com>
Tue, 20 Jan 2026 22:44:46 +0000 (14:44 -0800)
committerMiklos Szeredi <mszeredi@redhat.com>
Tue, 3 Mar 2026 09:05:39 +0000 (10:05 +0100)
commit65161470f95bb579a72673bf303ecf0800b9054b
treea4303a356eea3ff069b5fa68c89d5123bdf95709
parent59ba47b6be9cd0146ef9a55c6e32e337e11e7625
fuse: validate outarg offset and size in notify store/retrieve

Add validation checking for outarg offset and outarg size values passed
in by the server. MAX_LFS_FILESIZE is the maximum file size supported.
The fuse_notify_store_out and fuse_notify_retrieve_out structs take in
a uint64_t offset.

Add logic to ensure:
* outarg.offset is less than MAX_LFS_FILESIZE
* outarg.offset + outarg.size cannot exceed MAX_LFS_FILESIZE
* potential uint64_t overflow is fixed when adding outarg.offset and
  outarg.size.

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/dev.c