Re: [PATCH] fsverity: Be more careful with return value of ->get_verity_descriptor()

[sashiko-bot@kernel.org]

> If fsverity_operations::get_verity_descriptor() returns that the verity
> descriptor has 0 size, then a zero-size buffer is allocated to hold it,
> and it's called again with bufsize=0.
> 
> But bufsize=0 is a special case that says to return the actual size.  If
> in the meantime the filesystem has decided that the size is some
> actually valid size, it will return that size, and then
> validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash.
> 
> Of course, for the filesystem to misbehave in that strange way, it
> generally would require direct writes to the block device.
> 
> Regardless, fsverity_get_descriptor() might as well guard against it.
> Make it do so.  Specifically, validate that the first call to
> ->get_verity_descriptor() returns at least the minimum descriptor size,
> and validate that the second call returns the same size as the first.
> 
> Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025203831.120095-1-ebiggers@kernel.org?part=1