Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] fuse: negative backing ID validation bypass due to unsigned conversion --
commit 38737a0048b9ea224c699e27954c4cb00bdfc596 Author: Miklos Szeredi <[email protected]> fuse: support opening 64 bit backing ID This commit adds a backing_id_64 field to fuse_open_out to allow opening files with 64-bit server-allocated backing IDs. When the server sets FUSE_BACKING_ID_64, the kernel reads the backing ID from backing_id_64 instead of backing_id. > diff --git a/fs/fuse/iomode.c b/fs/fuse/iomode.c > index 1a10bc65fb310..811ea603b7767 100644 > --- a/fs/fuse/iomode.c > +++ b/fs/fuse/iomode.c > @@ -160,7 +160,9 @@ static int fuse_file_passthrough_open(struct inode > *inode, struct file *file) > { > struct fuse_file *ff = file->private_data; > struct fuse_conn *fc = get_fuse_conn(inode); > + struct fuse_open_out *outarg = &ff->args->open_outarg; > struct fuse_backing *fb; > + u64 backing_id; > int err; > > /* Check allowed conditions for file open in passthrough mode */ > @@ -170,18 +172,38 @@ static int fuse_file_passthrough_open(struct inode > *inode, struct file *file) > if (ff->open_flags & ~FOPEN_PASSTHROUGH_MASK) > return fuse_EIO("conflicting open flags"); > > - fb = fuse_passthrough_open(file, ff->args->open_outarg.backing_id); > - if (IS_ERR(fb)) > - return PTR_ERR(fb); > + if (!fc->backing_id_64) { > + if (outarg->backing_id_64 != 0) > + return fuse_EIO("64 bit backing ID set"); > + > + backing_id = outarg->backing_id; > + if (backing_id <= 0) [Severity: Low] Since outarg->backing_id is a signed 32-bit integer and backing_id is an unsigned 64-bit integer, will negative IDs bypass this explicit error check due to sign-extension during the assignment? If outarg->backing_id is negative, it gets sign-extended into a large positive value when assigned to the u64 backing_id. This causes the <= 0 check to evaluate to false, skipping the intended "invalid backing ID" validation. The code will then proceed and fail in fuse_backing_lookup(), logging "backing not found" instead of the expected "invalid backing ID" error. > + return fuse_EIO("invalid backing ID"); > + } else { > + if (outarg->backing_id != 0) > + return fuse_EIO("32 bit backing ID set"); > + > + backing_id = outarg->backing_id_64; > + } > + fb = fuse_backing_lookup(fc, backing_id); > + if (!fb) > + return fuse_EIO("backing not found"); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
