> A short successful virtiofs response can leave the fixed-output portion of
> the request argument buffer unwritten. The completion path nevertheless
> copies the full declared output to the request destination, allowing stale
> allocator contents to reach callers such as fuse_statfs().
>
> Require successful fixed-output responses to contain their complete
> declared output. Continue to permit a shorter final argument only for
> out_argvar requests. Reject positive and internal restart error values
> and require valid error replies to be header-only. The error already
> stored in the FUSE output header is returned by fuse_request_end(), so do
> not copy output arguments from an error reply.
>
> This was found by source review with AI assistance. A header-only
> successful FUSE_STATFS reply returned stale fields in nine of nine calls
> across three boots. The fixed kernel rejected the short response and
> preserved complete replies, valid negative-error replies, and
> variable-output replies.
>
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Sung Byeongchan <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
