Re: [PATCH v3] virtiofs: validate fixed-output response length

[sashiko-bot@kernel.org]

> A short successful virtiofs response can leave the fixed-output portion of
> the request argument buffer unwritten.  The completion path nevertheless
> copies the full declared output to the request destination, allowing stale
> allocator contents to reach callers such as fuse_statfs().
> 
> Require successful fixed-output responses to contain their complete
> declared output.  Continue to permit a shorter final argument only for
> out_argvar requests.  Reject positive and internal restart error values
> and require valid error replies to be header-only.  The error already
> stored in the FUSE output header is returned by fuse_request_end(), so do
> not copy output arguments from an error reply.
> 
> This was found by source review with AI assistance.  A header-only
> successful FUSE_STATFS reply returned stale fields in nine of nine calls
> across three boots.  The fixed kernel rejected the short response and
> preserved complete replies, valid negative-error replies, and
> variable-output replies.
> 
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007061949.23008-1-tjdqudcks0424@naver.com?part=1