Re: [PATCH] fsverity: Be more careful with return value of ->get_verity_descriptor()

[Eric Biggers <ebiggers@kernel.org>]

On Sun, Oct 25, 2026 at 01:38:31PM -0700, Eric Biggers wrote:
> If fsverity_operations::get_verity_descriptor() returns that the verity
> descriptor has 0 size, then a zero-size buffer is allocated to hold it,
> and it's called again with bufsize=0.
> 
> But bufsize=0 is a special case that says to return the actual size.  If
> in the meantime the filesystem has decided that the size is some
> actually valid size, it will return that size, and then
> validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash.
> 
> Of course, for the filesystem to misbehave in that strange way, it
> generally would require direct writes to the block device.
> 
> Regardless, fsverity_get_descriptor() might as well guard against it.
> Make it do so.  Specifically, validate that the first call to
> ->get_verity_descriptor() returns at least the minimum descriptor size,
> and validate that the second call returns the same size as the first.
> 
> Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Applied to https://git.kernel.org/pub/scm/fs/fsverity/linux.git/log/?h=for-current

- Eric