Re: [PATCH v2] virtiofs: validate fixed-output response length

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Oct 07, 2026 at 03:24:08AM +0900, sungbyeongchan wrote:
> A short successful virtiofs response can leave the fixed-output
> portion of the request argument buffer unwritten. The completion path
> nevertheless copies the full declared output to the request destination,
> allowing stale allocator contents to reach callers such as
> fuse_statfs().
> 
> Require successful fixed-output responses to contain their complete
> declared output. Continue to permit a shorter final argument only for
> out_argvar requests. Reject positive and internal restart error values,
> require valid error replies to be header-only, and do not copy output
> arguments from error replies.
> 
> A header-only FUSE_STATFS success returned stale fields in nine of
> nine calls across three boots. The fixed kernel rejected the short
> response and preserved complete replies, valid error replies, and
> variable-output controls.
> 
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <tjdqudcks0424@naver.com>

Real name please.

> ---
> Changes in v2:
> - Reject positive and internal restart error values.
> - Require error replies to be header-only.
> - Rate-limit malformed-response warnings.
> - Rely on the existing FUSE pr_fmt prefix.
> - Add Cc: stable@vger.kernel.org.
> - Use the reporter identity consistently.
> 
>  fs/fuse/virtio_fs.c | 43 ++++++++++++++++++++++++++++++++++++++-----
>  1 file changed, 38 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> index f15e516ebcb5c..fffbe08d9114a 100644
> --- a/fs/fuse/virtio_fs.c
> +++ b/fs/fuse/virtio_fs.c
> @@ -4,6 +4,8 @@
>   * Copyright (C) 2018 Red Hat, Inc.
>   */
>  
> +#include "fuse_i.h"
> +

Why is this moved?



>  #include <linux/fs.h>
>  #include <linux/dax.h>
>  #include <linux/pci.h>
> @@ -20,7 +22,6 @@
>  #include <linux/cleanup.h>
>  #include <linux/uio.h>
>  #include "dev.h"
> -#include "fuse_i.h"
>  #include "fuse_dev_i.h"
>  
>  /* Used to help calculate the FUSE connection's max_pages limit for a request's
> @@ -730,6 +731,10 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
>  	unsigned int num_out;
>  	unsigned int i;
>  
> +	/* Error replies contain only the output header. */
> +	if (req->out.h.error)
> +		goto out;

But no error is returned?

>  	if (len < sizeof(*oh)) {
> -		pr_warn("virtio-fs: response too short (%u)\n", len);
> +		pr_warn_ratelimited("response too short (%u)\n", len);

Isn't these ratelimited() changes separate from the original issue here?
That should be a separate patch.

thanks,

greg k-h