On Sun, Oct 04, 2026 at 09:34:05PM +0900, sungbyeongchan wrote:
> A short successful virtiofs response can leave the fixed-output
> portion of the request argument buffer unwritten. The completion path
> nevertheless copies the full declared output to the request destination,
> allowing stale allocator contents to reach callers such as
> fuse_statfs().
>
> Require successful fixed-output responses to contain their complete
> declared output. Continue to permit a shorter final argument only for
> out_argvar requests, and do not copy output arguments from error
> replies.
>
> A header-only FUSE_STATFS success returned stale fields in nine of
> nine calls across three boots. The patched kernel rejected the short
> response in three boots and preserved complete replies and existing
> error controls.
>
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Signed-off-by: sungbyeongchan <[email protected]>
> ---
> fs/fuse/virtio_fs.c | 26 ++++++++++++++++++++++++++
> 1 file changed, 26 insertions(+)
>
> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> index f15e516ebcb5c..288848f23e7ec 100644
> --- a/fs/fuse/virtio_fs.c
> +++ b/fs/fuse/virtio_fs.c
> @@ -730,6 +730,10 @@ static void copy_args_from_argbuf(struct fuse_args
> *args, struct fuse_req *req)
> unsigned int num_out;
> unsigned int i;
>
> + /* Error replies contain only the output header. */
> + if (req->out.h.error)
> + goto out;
> +
> remaining = req->out.h.len - sizeof(req->out.h);
> num_in = args->in_numargs - args->in_pages;
> num_out = args->out_numargs - args->out_pages;
> @@ -755,6 +759,7 @@ static void copy_args_from_argbuf(struct fuse_args *args,
> struct fuse_req *req)
> if (args->out_argvar)
> args->out_args[args->out_numargs - 1].size = remaining;
>
> +out:
> kfree(req->argbuf);
> req->argbuf = NULL;
> }
> @@ -762,7 +767,9 @@ static void copy_args_from_argbuf(struct fuse_args *args,
> struct fuse_req *req)
> /* Verify that the server properly follows the FUSE protocol */
> static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
> {
> + struct fuse_args *args = req->args;
> struct fuse_out_header *oh = &req->out.h;
> + unsigned int expected;
>
> if (len < sizeof(*oh)) {
> pr_warn("virtio-fs: response too short (%u)\n", len);
> @@ -777,6 +784,25 @@ static bool virtio_fs_verify_response(struct fuse_req
> *req, unsigned int len)
> oh->unique, req->in.h.unique);
> return false;
> }
> +
> + if (oh->error) {
> + if (len != sizeof(*oh)) {
> + pr_warn("virtio-fs: error response too long (%u)\n",
> len);
> + return false;
> + }
> + return true;
> + }
> +
> + expected = sizeof(*oh) +
> + fuse_len_args(args->out_numargs, args->out_args);
> + if (len > expected ||
> + (len < expected &&
> + (!args->out_argvar ||
> + expected - len > args->out_args[args->out_numargs - 1].size))) {
> + pr_warn("virtio-fs: invalid response length (%u, expected
> %u)\n",
> + len, expected);
why let remote connections spam the kernel log? And you don't need the
"prefix" of virtio-fs for pr_*() calls if it is working properly.
thanks,
greg k-h
