Re: [PATCH] virtiofs: Verify that server properly follows FUSE protocol

[Li Wang <liwang@kylinos.cn>]

Hi Stefan,

On 20/03/2026 23:00, Stefan Hajnoczi wrote:
> On Wed, Mar 18, 2026 at 10:58 PM Li Wang <liwang@kylinos.cn> wrote:
>>
>> Verify that server properly follows FUSE protocol, by checking
>> oh.uniq and oh.len.
>>
>> Signed-off-by: Li Wang <liwang@kylinos.cn>
>> ---
>>  fs/fuse/virtio_fs.c | 27 ++++++++++++++++++++++++++-
>>  1 file changed, 26 insertions(+), 1 deletion(-)
> 
> Earlier patch series addressing this:
> - https://lore.kernel.org/all/20251028200311.40372-1-brajeshpatil11@gmail.com/
> - https://lore.kernel.org/all/20260216073158.75151-1-ytohnuki@amazon.com/
> 
> The second one was applied and I think your version conflicts with it.
> 
> Please take a look and let us know whether you want to drop your patch
> or send a v2 rebased on Miklos latest tree
> (https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git).
> 

Thanks for the review, and I will submit a V2 to address your feedback.

Thanks,
Li

> Thanks,
> Stefan
> 
>>
>> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
>> index 057e65b51b99..c30f6f58664c 100644
>> --- a/fs/fuse/virtio_fs.c
>> +++ b/fs/fuse/virtio_fs.c
>> @@ -768,10 +768,34 @@ static void virtio_fs_request_complete(struct fuse_req *req,
>>         struct folio *folio;
>>
>>         /*
>> -        * TODO verify that server properly follows FUSE protocol
>> +        * Verify that server properly follows FUSE protocol
>>          * (oh.uniq, oh.len)
>>          */
>>         args = req->args;
>> +       if (test_bit(FR_ISREPLY, &req->flags)) {
>> +               struct fuse_out_header *oh = &req->out.h;
>> +
>> +               if (unlikely(oh->unique != req->in.h.unique)) {
>> +                       pr_warn_ratelimited("virtio-fs: bad reply unique %llu (expected %llu)\n",
>> +                                           oh->unique, req->in.h.unique);
>> +                       oh->error = -EIO;
>> +                       oh->len = sizeof(*oh);
>> +                       goto out;
>> +               }
>> +               unsigned int num_out = args->out_numargs - args->out_pages;
>> +               unsigned int cap = sizeof(req->out.h);
>> +
>> +               cap += fuse_len_args(num_out, args->out_args);
>> +               if (args->out_pages)
>> +                       cap += args->out_args[args->out_numargs - 1].size;
>> +               if (unlikely(oh->len < sizeof(*oh) || oh->len > cap)) {
>> +                       pr_warn_ratelimited("virtio-fs: bad reply len %u (cap %u)\n",
>> +                                           oh->len, cap);
>> +                       oh->error = -EIO;
>> +                       oh->len = sizeof(*oh);
>> +                       goto out;
>> +               }
>> +       }
>>         copy_args_from_argbuf(args, req);
>>
>>         if (args->out_pages && args->page_zeroing) {
>> @@ -790,6 +814,7 @@ static void virtio_fs_request_complete(struct fuse_req *req,
>>                 }
>>         }
>>
>> +out:
>>         clear_bit(FR_SENT, &req->flags);
>>
>>         fuse_request_end(req);
>> --
>> 2.34.1
>>
>>