fuse: reject oversized dirents in page cache

fuse_add_dirent_to_cache() computes a serialized dirent size from the
server-controlled namelen field and copies the dirent into a single
page-cache page. The existing logic only checks whether the dirent fits
in the remaining space of the current page and advances to a fresh page
if not. It never checks whether the dirent itself exceeds PAGE_SIZE.

As a result, a malicious FUSE server can return a dirent with
namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB
page systems this causes memcpy() to overflow the cache page by 24 bytes
into the following kernel page.

Reject dirents that cannot fit in a single page before copying them into
the readdir cache.

Fixes: 69e3455 ("fuse: allow caching readdir")
Cc: [email protected] # v6.16+
Assisted-by: Bynario AI
Signed-off-by: Samuel Page <[email protected]>
Reported-by: Qi Tang <[email protected]>
Reported-by: Zijun Hu <[email protected]>
Signed-off-by: Miklos Szeredi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Christian Brauner <[email protected]>

Author: sam4k

fs/fuse/readdir.c

@@ -41,6 +41,10 @@ static void fuse_add_dirent_to_cache(struct file *file,
 	unsigned int offset;
 	void *addr;
 
+	/* Dirent doesn't fit in readdir cache page?  Skip caching. */
+	if (reclen > PAGE_SIZE)
+		return;
+
 	spin_lock(&fi->rdc.lock);
 	/*
 	 * Is cache already completed?  Or this entry does not go at the end of