The branch main has been updated by olce:
URL:
https://cgit.FreeBSD.org/src/commit/?id=d22592cd6fd2d39432add376dad460a66488a846
commit d22592cd6fd2d39432add376dad460a66488a846
Author: Olivier Certner <o...@freebsd.org>
AuthorDate: 2025-08-26 12:39:16 +0000
Commit: Olivier Certner <o...@freebsd.org>
CommitDate: 2025-09-17 12:16:01 +0000
fuse: Fix GID when sending FUSE_INTERRUPT to a FUSE daemon
Due to the partial-only changes of commit 46c07316f906 ("kern: adopt the
cr_gid macro for cr_groups[0] more widely"), subsequent commit
be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
caused a mismatch between filling cr_groups[0] in 'reused_creds' in
fuse_interrupt_send() and reading 'cr_gid' from it in
fuse_setup_ihead(), with the consequence that the kernel would send
a FUSE_INTERRUPT message to the FUSE deamon with an uninitialized GID in
its header (which, besides being wrong, would disclose 4 bytes from its
stack).
Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of
cr_groups[]")
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52255
---
sys/fs/fuse/fuse_ipc.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sys/fs/fuse/fuse_ipc.c b/sys/fs/fuse/fuse_ipc.c
index a751c09159ff..7f754ab7f1d4 100644
--- a/sys/fs/fuse/fuse_ipc.c
+++ b/sys/fs/fuse/fuse_ipc.c
@@ -193,7 +193,6 @@ fuse_interrupt_send(struct fuse_ticket *otick, int err)
struct fuse_data *data = otick->tk_data;
struct fuse_ticket *tick, *xtick;
struct ucred reused_creds;
- gid_t reused_groups[1];
if (otick->irq_unique == 0) {
/*
@@ -237,8 +236,7 @@ fuse_interrupt_send(struct fuse_ticket *otick, int err)
*/
ftick_hdr = fticket_in_header(otick);
reused_creds.cr_uid = ftick_hdr->uid;
- reused_groups[0] = ftick_hdr->gid;
- reused_creds.cr_groups = reused_groups;
+ reused_creds.cr_gid = ftick_hdr->gid;
fdisp_init(&fdi, sizeof(*fii));
fdisp_make_pid(&fdi, FUSE_INTERRUPT, data, ftick_hdr->nodeid,
ftick_hdr->pid, &reused_creds);
