In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() r

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: fix EFAULT clobber in fuse_uring_commit

copy_from_user() returns the number of bytes not copied as an unsigned
residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit
stores that residual in ssize_t err, sets req->out.h.error to -EFAULT,
then jumps to out: with err still holding the positive residual.

 1err = copy_from_user(&req->out.h, &ent->headers->in_out,
 2                     sizeof(req->out.h));
 3if (err) {
 4    req->out.h.error = -EFAULT;
 5    goto out;          /* err is the positive residual */
 6}
 7...
 8out:
 9    fuse_uring_req_end(ent, req, err);

fuse_uring_req_end() then runs

 1if (error)
 2    req->out.h.error = error;

which overwrites the just-assigned -EFAULT with the positive residual.
FUSE callers such as fuse_simple_request() test err < 0 to detect
failure, so the positive value is interpreted as success and the
caller proceeds with an uninitialised or partial req->out.args.

Fix by assigning err = -EFAULT in the failure branch before jumping
to out, so fuse_uring_req_end() receives a negative errno and sets
req->out.h.error to -EFAULT.