[query] payload size check in fuse_uring_create_ring_ent

[query] payload size check in fuse_uring_create_ring_ent

[ALOK TIWARI]

Hi,

I am wondering if this condition is intentional.
It seems that ring->max_payload_sz represents the maximum allowed 
payload size, so rejecting payloads smaller than that looks unexpected.

Could you please confirm whether the current < check is correct or
if this should be > instead?

24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")

Thanks,
Alok
---
diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
index f6b12aebb8bb..4106fc80c1e8 100644
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -1051,7 +1051,7 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
         }

         payload_size = iov[1].iov_len;
-       if (payload_size < ring->max_payload_sz) {
+       if (payload_size > ring->max_payload_sz) {
                 pr_info_ratelimited("Invalid req payload len %zu\n",
                                     payload_size);

Re: [query] payload size check in fuse_uring_create_ring_ent

[Bernd Schubert]

On 10/27/25 15:49, ALOK TIWARI wrote:
> [You don't often get email from alok.a.tiwari@oracle.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Hi,
> 
> I am wondering if this condition is intentional.
> It seems that ring->max_payload_sz represents the maximum allowed
> payload size, so rejecting payloads smaller than that looks unexpected.
> 
> Could you please confirm whether the current < check is correct or
> if this should be > instead?
> 
> 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")
> 
> Thanks,
> Alok
> ---
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index f6b12aebb8bb..4106fc80c1e8 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -1051,7 +1051,7 @@ fuse_uring_create_ring_ent(struct io_uring_cmd *cmd,
>          }
> 
>          payload_size = iov[1].iov_len;
> -       if (payload_size < ring->max_payload_sz) {
> +       if (payload_size > ring->max_payload_sz) {
>                  pr_info_ratelimited("Invalid req payload len %zu\n",
>                                      payload_size);
> 

See the calculation of of ring->max_payload_sz in fuse_uring_create(), i.e.
it determines the maximum payload an entry buffer could ever have.

We don't care if fuse-server made a mistake and uses 
payload_size > ring->max_payload_sz, just a waste of memory then. Though,
if payload_size < ring->max_payload_sz, it could not handle IO sizes given
by  fc->max_write, fc->max_pages or FUSE_MIN_READ_BUFFER.


Thanks,
Bernd