Re: [PATCH v2 4/8] fuse: support opening 64 bit backing ID

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] fuse: negative backing ID validation bypass due to unsigned conversion
--

commit 38737a0048b9ea224c699e27954c4cb00bdfc596
Author: Miklos Szeredi <mszeredi@redhat.com>

fuse: support opening 64 bit backing ID

This commit adds a backing_id_64 field to fuse_open_out to allow opening
files with 64-bit server-allocated backing IDs. When the server sets
FUSE_BACKING_ID_64, the kernel reads the backing ID from backing_id_64
instead of backing_id.

> diff --git a/fs/fuse/iomode.c b/fs/fuse/iomode.c
> index 1a10bc65fb310..811ea603b7767 100644
> --- a/fs/fuse/iomode.c
> +++ b/fs/fuse/iomode.c
> @@ -160,7 +160,9 @@ static int fuse_file_passthrough_open(struct inode *inode, struct file *file)
>  {
>  	struct fuse_file *ff = file->private_data;
>  	struct fuse_conn *fc = get_fuse_conn(inode);
> +	struct fuse_open_out *outarg = &ff->args->open_outarg;
>  	struct fuse_backing *fb;
> +	u64 backing_id;
>  	int err;
>  
>  	/* Check allowed conditions for file open in passthrough mode */
> @@ -170,18 +172,38 @@ static int fuse_file_passthrough_open(struct inode *inode, struct file *file)
>  	if (ff->open_flags & ~FOPEN_PASSTHROUGH_MASK)
>  		return fuse_EIO("conflicting open flags");
>  
> -	fb = fuse_passthrough_open(file, ff->args->open_outarg.backing_id);
> -	if (IS_ERR(fb))
> -		return PTR_ERR(fb);
> +	if (!fc->backing_id_64) {
> +		if (outarg->backing_id_64 != 0)
> +			return fuse_EIO("64 bit backing ID set");
> +
> +		backing_id = outarg->backing_id;
> +		if (backing_id <= 0)

[Severity: Low]
Since outarg->backing_id is a signed 32-bit integer and backing_id is an
unsigned 64-bit integer, will negative IDs bypass this explicit error check
due to sign-extension during the assignment?

If outarg->backing_id is negative, it gets sign-extended into a large
positive value when assigned to the u64 backing_id. This causes the <= 0
check to evaluate to false, skipping the intended "invalid backing ID"
validation.

The code will then proceed and fail in fuse_backing_lookup(), logging
"backing not found" instead of the expected "invalid backing ID" error.

> +			return fuse_EIO("invalid backing ID");
> +	} else {
> +		if (outarg->backing_id != 0)
> +			return fuse_EIO("32 bit backing ID set");
> +
> +		backing_id = outarg->backing_id_64;
> +	}
> +	fb = fuse_backing_lookup(fc, backing_id);
> +	if (!fb)
> +		return fuse_EIO("backing not found");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001150935.655979-1-mszeredi@redhat.com?part=4