Re: [query] payload size check in fuse_uring_create_ring_ent

[Bernd Schubert <bschubert@ddn.com>]

On 10/27/25 15:49, ALOK TIWARI wrote:
> [You don't often get email from alok.a.tiwari@oracle.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Hi,
> 
> I am wondering if this condition is intentional.
> It seems that ring->max_payload_sz represents the maximum allowed
> payload size, so rejecting payloads smaller than that looks unexpected.
> 
> Could you please confirm whether the current < check is correct or
> if this should be > instead?
> 
> 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")
> 
> Thanks,
> Alok
> ---
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index f6b12aebb8bb..4106fc80c1e8 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -1051,7 +1051,7 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
>          }
> 
>          payload_size = iov[1].iov_len;
> -       if (payload_size < ring->max_payload_sz) {
> +       if (payload_size > ring->max_payload_sz) {
>                  pr_info_ratelimited("Invalid req payload len %zu\n",
>                                      payload_size);
> 

See the calculation of of ring->max_payload_sz in fuse_uring_create(), i.e.
it determines the maximum payload an entry buffer could ever have.

We don't care if fuse-server made a mistake and uses 
payload_size > ring->max_payload_sz, just a waste of memory then. Though,
if payload_size < ring->max_payload_sz, it could not handle IO sizes given
by  fc->max_write, fc->max_pages or FUSE_MIN_READ_BUFFER.


Thanks,
Bernd