FUSE requests that do not set FR_ISREPLY never map fuse_out_header or reply payload into the virtqueue in virtio_fs_enqueue_req(). For example, for the FORGET requests sent in fuse_force_forget(), req->out.h.len is initialized to 0 in fuse_request_alloc(). On completion, copy_args_from_argbuf() must not run: it subtracts sizeof(fuse_out_header) from req->out.h.len, which will cause an underflow.
Always free the bounce buffer allocated by copy_args_to_argbuf() on the no-reply path so virtio_fs_enqueue_req() does not leak argbuf. In virtio_fs_requests_done_work(), only call virtio_fs_verify_response() when FR_ISREPLY is set. Signed-off-by: Li Wang <[email protected]> --- fs/fuse/virtio_fs.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index 2f7485ffac52..670dd413873b 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -789,7 +789,13 @@ static void virtio_fs_request_complete(struct fuse_req *req, struct folio *folio; args = req->args; - copy_args_from_argbuf(args, req); + if (test_bit(FR_ISREPLY, &req->flags)) + copy_args_from_argbuf(args, req); + else if (req->argbuf) { + /* Bounce buffer from virtio_fs_enqueue_req(); no reply payload to copy */ + kfree(req->argbuf); + req->argbuf = NULL; + } if (args->out_pages && args->page_zeroing) { len = args->out_args[args->out_numargs - 1].size; @@ -841,9 +847,11 @@ static void virtio_fs_requests_done_work(struct work_struct *work) virtqueue_disable_cb(vq); while ((req = virtqueue_get_buf(vq, &len)) != NULL) { - if (!virtio_fs_verify_response(req, len)) { - req->out.h.error = -EIO; - req->out.h.len = sizeof(struct fuse_out_header); + if (test_bit(FR_ISREPLY, &req->flags)) { + if (!virtio_fs_verify_response(req, len)) { + req->out.h.error = -EIO; + req->out.h.len = sizeof(struct fuse_out_header); + } } spin_lock(&fpq->lock); list_move_tail(&req->list, &reqs); -- 2.34.1
