6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joanne Koong [ Upstream commit ba7d47897fd895533c19af436ca7fc4f6b171238 ] Move header copying from ring logic into a new copy_header_from_ring() function. This makes the copy_from_user() logic more clear and centralizes error handling / rate-limited logging. Reviewed-by: Bernd Schubert Reviewed-by: Jeff Layton Reviewed-by: Baokun Li Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi Stable-dep-of: fd10f40af314 ("fuse: copy request headers via a stack buffer for io-uring") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- fs/fuse/dev_uring.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) --- a/fs/fuse/dev_uring.c +++ b/fs/fuse/dev_uring.c @@ -593,6 +593,18 @@ static __always_inline int copy_header_t return 0; } +static __always_inline int copy_header_from_ring(void *header, + const void __user *ring, + size_t header_size) +{ + if (copy_from_user(header, ring, header_size)) { + pr_info_ratelimited("Copying header from ring failed.\n"); + return -EFAULT; + } + + return 0; +} + static int fuse_uring_copy_from_ring(struct fuse_ring *ring, struct fuse_req *req, struct fuse_ring_ent *ent) @@ -603,10 +615,10 @@ static int fuse_uring_copy_from_ring(str int err; struct fuse_uring_ent_in_out ring_in_out; - err = copy_from_user(&ring_in_out, &ent->headers->ring_ent_in_out, - sizeof(ring_in_out)); + err = copy_header_from_ring(&ring_in_out, &ent->headers->ring_ent_in_out, + sizeof(ring_in_out)); if (err) - return -EFAULT; + return err; err = import_ubuf(ITER_SOURCE, ent->payload, ring->max_payload_sz, &iter); @@ -842,8 +854,8 @@ static void fuse_uring_commit(struct fus struct fuse_conn *fc = ring->fc; ssize_t err = -EFAULT; - if (copy_from_user(&req->out.h, &ent->headers->in_out, - sizeof(req->out.h))) + if (copy_header_from_ring(&req->out.h, &ent->headers->in_out, + sizeof(req->out.h))) goto out; err = fuse_uring_out_header_has_err(&req->out.h, req, fc);