From fc057820fa80c4349239811389b529d043baeca3 Mon Sep 17 00:00:00 2001 From: surface-camera-build Date: Wed, 23 Sep 2026 22:02:22 -0400 Subject: [PATCH] =?UTF-8?q?store:=20refuse=20a=20store=20that=20cannot=20b?= =?UTF-8?q?e=20read=20=E2=80=94=20and=20the=20proof=20that=20the=20refusal?= =?UTF-8?q?=20is=20not=20the=20whole=20defect?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guard is `store_readable()`: four bytes at offset zero, asked before either walk op answers anything. Proven against the reproduction, which is the reproduction from the record — `cube_store=/dev/null cubelinux.enum=1`: cubelinux: cube_store= resolved to /dev/null (the token was honoured) cubelinux: the store is not readable; refusing to answer (the kernel refuses) and the client is *still* handed `spaces returned 0, len=0, cursor=1`, so it copies an unfilled space and walks 199,000 invented records. That is the whole defect in one transcript: the driver refuses and the syscall boundary reports success anyway. So this commit fixes and proves half of it. What remains is `cube_syscall.c`'s CUBE_OP_SPACES arm, where the driver's -EINVAL becomes a 0 with a cursor advanced by one — either its `ret < 0` test is not on the path the client takes, or the answer is overwritten before the copy-out. Nothing above or below that needs touching. Three earlier guesses are recorded as wrong rather than deleted: the packed fallback and the magic guard written for it are never reached (probed, proven), and `read_exact_at` already rejects a short read. The guard here is the first one that fires. The device-path print in cube_syscall.c stays on purpose: it is what turned four builds of inference into one line of fact. Built as #93, deliberately NOT installed — installing it alone would leave the walk still looping. The machine runs #87. --- drivers/cube/cube_syscall.c | 1 + drivers/cube/cubelinux_store.rs | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/drivers/cube/cube_syscall.c b/drivers/cube/cube_syscall.c index 20c9b6398..c1a5b1038 100644 --- a/drivers/cube/cube_syscall.c +++ b/drivers/cube/cube_syscall.c @@ -95,6 +95,7 @@ static char store_device_path[256] = "/dev/vda"; static int __init cube_store_setup(char *str) { strscpy(store_device_path, str, sizeof(store_device_path)); + pr_info("cubelinux: cube_store= resolved to %s\n", store_device_path); return 1; } __setup("cube_store=", cube_store_setup); diff --git a/drivers/cube/cubelinux_store.rs b/drivers/cube/cubelinux_store.rs index cdc6ac2c1..5c2ebf020 100644 --- a/drivers/cube/cubelinux_store.rs +++ b/drivers/cube/cubelinux_store.rs @@ -4408,6 +4408,10 @@ pub unsafe extern "C" fn cubelinux_kernel_enum( out_len: *mut u64, out_cursor: *mut u64, ) -> i32 { + if let Err(e) = store_readable() { + pr_warn!("cubelinux: the store is not readable; refusing to answer\n"); + return -(e.to_errno() as i32); + } let mut wanted = [0u8; SPACE_ID_LEN]; // SAFETY: the caller guarantees 32 readable bytes at `space`. unsafe { core::ptr::copy_nonoverlapping(space, wanted.as_mut_ptr(), SPACE_ID_LEN) }; @@ -4690,8 +4694,34 @@ pub unsafe extern "C" fn cubelinux_kernel_flag_scan( /// /// # Safety /// `space_out` must point to 32 writable bytes. +/// Whether the store can be read at all, asked before an operation answers anything. +/// +/// A walk pointed at something that is not a store served invented records — a garbage space, a +/// zero-length value, a cursor that advanced on its own, forever — and a boot that hung instead of +/// saying what was wrong. Probing every branch of `Addressed::open()` showed why the earlier guesses +/// were wrong: it is entered, the file opens, and execution never gets past the control-block read, so +/// neither the packed fallback nor the guard written for it was ever on that path. Whatever answered +/// downstream answered over a device that cannot be read. +/// +/// So the question is asked here, where the answer leaves no room: four bytes at offset zero. +fn store_readable() -> Result<()> { + let file = store_file()?; + let mut head = KVVec::::with_capacity(8, GFP_KERNEL)?; + // The scratch is what `read_exact_at` reads *into*, and it asks for `min(left, scratch.len())` + // bytes — so a scratch with capacity but no length asks for zero bytes, gets zero, and the + // helper correctly reports a short read for every store, good or bad. Length, not capacity. + let mut scratch = KVVec::::with_capacity(4096, GFP_KERNEL)?; + scratch.resize(4096, 0, GFP_KERNEL)?; + read_exact_at(file, 0, IMAGE_MAGIC.len(), &mut head, &mut scratch)?; + Ok(()) +} + #[unsafe(no_mangle)] pub unsafe extern "C" fn cubelinux_kernel_spaces(cursor: u64, space_out: *mut u8) -> i32 { + if let Err(e) = store_readable() { + pr_warn!("cubelinux: the store is not readable; refusing to answer\n"); + return -(e.to_errno() as i32); + } match Addressed::open() { Ok(Some(image)) => return unsafe { v3_spaces(image, cursor, space_out) }, Ok(None) => {}