Re: [PATCH] fuse: fix writeback array overflow when max_pages is one

[Christian Brauner <brauner@kernel.org>]

On Wed, 06 May 2026 20:24:15 +0800, Junxi Qian wrote:
> fuse_iomap_writeback_range() appends one folio pointer and one
> fuse_folio_desc for every dirty range that is merged into the current
> writeback request.  The merge decision checks the byte budget against
> fc->max_pages and fc->max_write, but it does not check whether the folio
> and descriptor arrays still have another free slot.
> 
> This is not sufficient for fuseblk, where the filesystem block size can
> be smaller than PAGE_SIZE.  With writeback cache enabled and max_pages
> negotiated as one, contiguous sub-page dirty ranges can fit within the
> byte budget while spanning more than one folio.  The next append can then
> write past the one-slot folios and descs arrays.
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] fuse: fix writeback array overflow when max_pages is one
      https://git.kernel.org/vfs/vfs/c/fde8a3147d3b