On Wed, Oct 07, 2026 at 03:24:08AM +0900, sungbyeongchan wrote:
> A short successful virtiofs response can leave the fixed-output
> portion of the request argument buffer unwritten. The completion path
> nevertheless copies the full declared output to the request destination,
> allowing stale allocator contents to reach callers such as
> fuse_statfs().
>
> Require successful fixed-output responses to contain their complete
> declared output. Continue to permit a shorter final argument only for
> out_argvar requests. Reject positive and internal restart error values,
> require valid error replies to be header-only, and do not copy output
> arguments from error replies.
>
> A header-only FUSE_STATFS success returned stale fields in nine of
> nine calls across three boots. The fixed kernel rejected the short
> response and preserved complete replies, valid error replies, and
> variable-output controls.
>
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <[email protected]>
Real name please.
> ---
> Changes in v2:
> - Reject positive and internal restart error values.
> - Require error replies to be header-only.
> - Rate-limit malformed-response warnings.
> - Rely on the existing FUSE pr_fmt prefix.
> - Add Cc: [email protected].
> - Use the reporter identity consistently.
>
> fs/fuse/virtio_fs.c | 43 ++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 38 insertions(+), 5 deletions(-)
>
> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> index f15e516ebcb5c..fffbe08d9114a 100644
> --- a/fs/fuse/virtio_fs.c
> +++ b/fs/fuse/virtio_fs.c
> @@ -4,6 +4,8 @@
> * Copyright (C) 2018 Red Hat, Inc.
> */
>
> +#include "fuse_i.h"
> +
Why is this moved?
> #include <linux/fs.h>
> #include <linux/dax.h>
> #include <linux/pci.h>
> @@ -20,7 +22,6 @@
> #include <linux/cleanup.h>
> #include <linux/uio.h>
> #include "dev.h"
> -#include "fuse_i.h"
> #include "fuse_dev_i.h"
>
> /* Used to help calculate the FUSE connection's max_pages limit for a
> request's
> @@ -730,6 +731,10 @@ static void copy_args_from_argbuf(struct fuse_args
> *args, struct fuse_req *req)
> unsigned int num_out;
> unsigned int i;
>
> + /* Error replies contain only the output header. */
> + if (req->out.h.error)
> + goto out;
But no error is returned?
> if (len < sizeof(*oh)) {
> - pr_warn("virtio-fs: response too short (%u)\n", len);
> + pr_warn_ratelimited("response too short (%u)\n", len);
Isn't these ratelimited() changes separate from the original issue here?
That should be a separate patch.
thanks,
greg k-h
