On Tue, Oct 06, 2026 at 11:11:14PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Oct 07, 2026 at 03:24:08AM +0900, sungbyeongchan wrote:
> > A short successful virtiofs response can leave the fixed-output
> > portion of the request argument buffer unwritten. The completion path
> > nevertheless copies the full declared output to the request destination,
> > allowing stale allocator contents to reach callers such as
> > fuse_statfs().
> >
> > Require successful fixed-output responses to contain their complete
> > declared output. Continue to permit a shorter final argument only for
> > out_argvar requests. Reject positive and internal restart error values,
> > require valid error replies to be header-only, and do not copy output
> > arguments from error replies.
> >
> > A header-only FUSE_STATFS success returned stale fields in nine of
> > nine calls across three boots. The fixed kernel rejected the short
> > response and preserved complete replies, valid error replies, and
> > variable-output controls.
> >
> > Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> > Cc: [email protected]
> > Assisted-by: LLM
> > Signed-off-by: sungbyeongchan <[email protected]>
>
> Real name please.
a missing space I guess?
> > ---
> > Changes in v2:
> > - Reject positive and internal restart error values.
> > - Require error replies to be header-only.
> > - Rate-limit malformed-response warnings.
> > - Rely on the existing FUSE pr_fmt prefix.
> > - Add Cc: [email protected].
> > - Use the reporter identity consistently.
> >
> > fs/fuse/virtio_fs.c | 43 ++++++++++++++++++++++++++++++++++++++-----
> > 1 file changed, 38 insertions(+), 5 deletions(-)
> >
> > diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> > index f15e516ebcb5c..fffbe08d9114a 100644
> > --- a/fs/fuse/virtio_fs.c
> > +++ b/fs/fuse/virtio_fs.c
> > @@ -4,6 +4,8 @@
> > * Copyright (C) 2018 Red Hat, Inc.
> > */
> >
> > +#include "fuse_i.h"
> > +
>
> Why is this moved?
>
>
>
> > #include <linux/fs.h>
> > #include <linux/dax.h>
> > #include <linux/pci.h>
> > @@ -20,7 +22,6 @@
> > #include <linux/cleanup.h>
> > #include <linux/uio.h>
> > #include "dev.h"
> > -#include "fuse_i.h"
> > #include "fuse_dev_i.h"
> >
> > /* Used to help calculate the FUSE connection's max_pages limit for a
> > request's
> > @@ -730,6 +731,10 @@ static void copy_args_from_argbuf(struct fuse_args
> > *args, struct fuse_req *req)
> > unsigned int num_out;
> > unsigned int i;
> >
> > + /* Error replies contain only the output header. */
> > + if (req->out.h.error)
> > + goto out;
>
> But no error is returned?
>
> > if (len < sizeof(*oh)) {
> > - pr_warn("virtio-fs: response too short (%u)\n", len);
> > + pr_warn_ratelimited("response too short (%u)\n", len);
>
> Isn't these ratelimited() changes separate from the original issue here?
> That should be a separate patch.
>
> thanks,
>
> greg k-h
