* [PATCH] virtiofs: Verify that server properly follows FUSE protocol
@ 2026-03-19 2:56 Li Wang
2026-03-20 15:00 ` Stefan Hajnoczi
0 siblings, 1 reply; 3+ messages in thread
From: Li Wang @ 2026-03-19 2:56 UTC (permalink / raw)
To: German Maglione, Vivek Goyal, Stefan Hajnoczi, Miklos Szeredi
Cc: Eugenio Pérez, virtualization, linux-fsdevel, Li Wang
Verify that server properly follows FUSE protocol, by checking
oh.uniq and oh.len.
Signed-off-by: Li Wang <liwang@kylinos.cn>
---
fs/fuse/virtio_fs.c | 27 ++++++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 057e65b51b99..c30f6f58664c 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -768,10 +768,34 @@ static void virtio_fs_request_complete(struct fuse_req *req,
struct folio *folio;
/*
- * TODO verify that server properly follows FUSE protocol
+ * Verify that server properly follows FUSE protocol
* (oh.uniq, oh.len)
*/
args = req->args;
+ if (test_bit(FR_ISREPLY, &req->flags)) {
+ struct fuse_out_header *oh = &req->out.h;
+
+ if (unlikely(oh->unique != req->in.h.unique)) {
+ pr_warn_ratelimited("virtio-fs: bad reply unique %llu (expected %llu)\n",
+ oh->unique, req->in.h.unique);
+ oh->error = -EIO;
+ oh->len = sizeof(*oh);
+ goto out;
+ }
+ unsigned int num_out = args->out_numargs - args->out_pages;
+ unsigned int cap = sizeof(req->out.h);
+
+ cap += fuse_len_args(num_out, args->out_args);
+ if (args->out_pages)
+ cap += args->out_args[args->out_numargs - 1].size;
+ if (unlikely(oh->len < sizeof(*oh) || oh->len > cap)) {
+ pr_warn_ratelimited("virtio-fs: bad reply len %u (cap %u)\n",
+ oh->len, cap);
+ oh->error = -EIO;
+ oh->len = sizeof(*oh);
+ goto out;
+ }
+ }
copy_args_from_argbuf(args, req);
if (args->out_pages && args->page_zeroing) {
@@ -790,6 +814,7 @@ static void virtio_fs_request_complete(struct fuse_req *req,
}
}
+out:
clear_bit(FR_SENT, &req->flags);
fuse_request_end(req);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] virtiofs: Verify that server properly follows FUSE protocol
2026-03-19 2:56 [PATCH] virtiofs: Verify that server properly follows FUSE protocol Li Wang
@ 2026-03-20 15:00 ` Stefan Hajnoczi
2026-03-23 1:58 ` Li Wang
0 siblings, 1 reply; 3+ messages in thread
From: Stefan Hajnoczi @ 2026-03-20 15:00 UTC (permalink / raw)
To: Li Wang
Cc: German Maglione, Vivek Goyal, Stefan Hajnoczi, Miklos Szeredi,
Eugenio Pérez, virtualization, linux-fsdevel
On Wed, Mar 18, 2026 at 10:58 PM Li Wang <liwang@kylinos.cn> wrote:
>
> Verify that server properly follows FUSE protocol, by checking
> oh.uniq and oh.len.
>
> Signed-off-by: Li Wang <liwang@kylinos.cn>
> ---
> fs/fuse/virtio_fs.c | 27 ++++++++++++++++++++++++++-
> 1 file changed, 26 insertions(+), 1 deletion(-)
Earlier patch series addressing this:
- https://lore.kernel.org/all/20251028200311.40372-1-brajeshpatil11@gmail.com/
- https://lore.kernel.org/all/20260216073158.75151-1-ytohnuki@amazon.com/
The second one was applied and I think your version conflicts with it.
Please take a look and let us know whether you want to drop your patch
or send a v2 rebased on Miklos latest tree
(https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git).
Thanks,
Stefan
>
> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> index 057e65b51b99..c30f6f58664c 100644
> --- a/fs/fuse/virtio_fs.c
> +++ b/fs/fuse/virtio_fs.c
> @@ -768,10 +768,34 @@ static void virtio_fs_request_complete(struct fuse_req *req,
> struct folio *folio;
>
> /*
> - * TODO verify that server properly follows FUSE protocol
> + * Verify that server properly follows FUSE protocol
> * (oh.uniq, oh.len)
> */
> args = req->args;
> + if (test_bit(FR_ISREPLY, &req->flags)) {
> + struct fuse_out_header *oh = &req->out.h;
> +
> + if (unlikely(oh->unique != req->in.h.unique)) {
> + pr_warn_ratelimited("virtio-fs: bad reply unique %llu (expected %llu)\n",
> + oh->unique, req->in.h.unique);
> + oh->error = -EIO;
> + oh->len = sizeof(*oh);
> + goto out;
> + }
> + unsigned int num_out = args->out_numargs - args->out_pages;
> + unsigned int cap = sizeof(req->out.h);
> +
> + cap += fuse_len_args(num_out, args->out_args);
> + if (args->out_pages)
> + cap += args->out_args[args->out_numargs - 1].size;
> + if (unlikely(oh->len < sizeof(*oh) || oh->len > cap)) {
> + pr_warn_ratelimited("virtio-fs: bad reply len %u (cap %u)\n",
> + oh->len, cap);
> + oh->error = -EIO;
> + oh->len = sizeof(*oh);
> + goto out;
> + }
> + }
> copy_args_from_argbuf(args, req);
>
> if (args->out_pages && args->page_zeroing) {
> @@ -790,6 +814,7 @@ static void virtio_fs_request_complete(struct fuse_req *req,
> }
> }
>
> +out:
> clear_bit(FR_SENT, &req->flags);
>
> fuse_request_end(req);
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] virtiofs: Verify that server properly follows FUSE protocol
2026-03-20 15:00 ` Stefan Hajnoczi
@ 2026-03-23 1:58 ` Li Wang
0 siblings, 0 replies; 3+ messages in thread
From: Li Wang @ 2026-03-23 1:58 UTC (permalink / raw)
To: Stefan Hajnoczi
Cc: German Maglione, Vivek Goyal, Stefan Hajnoczi, Miklos Szeredi,
Eugenio Pérez, virtualization, linux-fsdevel
Hi Stefan,
On 20/03/2026 23:00, Stefan Hajnoczi wrote:
> On Wed, Mar 18, 2026 at 10:58 PM Li Wang <liwang@kylinos.cn> wrote:
>>
>> Verify that server properly follows FUSE protocol, by checking
>> oh.uniq and oh.len.
>>
>> Signed-off-by: Li Wang <liwang@kylinos.cn>
>> ---
>> fs/fuse/virtio_fs.c | 27 ++++++++++++++++++++++++++-
>> 1 file changed, 26 insertions(+), 1 deletion(-)
>
> Earlier patch series addressing this:
> - https://lore.kernel.org/all/20251028200311.40372-1-brajeshpatil11@gmail.com/
> - https://lore.kernel.org/all/20260216073158.75151-1-ytohnuki@amazon.com/
>
> The second one was applied and I think your version conflicts with it.
>
> Please take a look and let us know whether you want to drop your patch
> or send a v2 rebased on Miklos latest tree
> (https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git).
>
Thanks for the review, and I will submit a V2 to address your feedback.
Thanks,
Li
> Thanks,
> Stefan
>
>>
>> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
>> index 057e65b51b99..c30f6f58664c 100644
>> --- a/fs/fuse/virtio_fs.c
>> +++ b/fs/fuse/virtio_fs.c
>> @@ -768,10 +768,34 @@ static void virtio_fs_request_complete(struct fuse_req *req,
>> struct folio *folio;
>>
>> /*
>> - * TODO verify that server properly follows FUSE protocol
>> + * Verify that server properly follows FUSE protocol
>> * (oh.uniq, oh.len)
>> */
>> args = req->args;
>> + if (test_bit(FR_ISREPLY, &req->flags)) {
>> + struct fuse_out_header *oh = &req->out.h;
>> +
>> + if (unlikely(oh->unique != req->in.h.unique)) {
>> + pr_warn_ratelimited("virtio-fs: bad reply unique %llu (expected %llu)\n",
>> + oh->unique, req->in.h.unique);
>> + oh->error = -EIO;
>> + oh->len = sizeof(*oh);
>> + goto out;
>> + }
>> + unsigned int num_out = args->out_numargs - args->out_pages;
>> + unsigned int cap = sizeof(req->out.h);
>> +
>> + cap += fuse_len_args(num_out, args->out_args);
>> + if (args->out_pages)
>> + cap += args->out_args[args->out_numargs - 1].size;
>> + if (unlikely(oh->len < sizeof(*oh) || oh->len > cap)) {
>> + pr_warn_ratelimited("virtio-fs: bad reply len %u (cap %u)\n",
>> + oh->len, cap);
>> + oh->error = -EIO;
>> + oh->len = sizeof(*oh);
>> + goto out;
>> + }
>> + }
>> copy_args_from_argbuf(args, req);
>>
>> if (args->out_pages && args->page_zeroing) {
>> @@ -790,6 +814,7 @@ static void virtio_fs_request_complete(struct fuse_req *req,
>> }
>> }
>>
>> +out:
>> clear_bit(FR_SENT, &req->flags);
>>
>> fuse_request_end(req);
>> --
>> 2.34.1
>>
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-23 1:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-19 2:56 [PATCH] virtiofs: Verify that server properly follows FUSE protocol Li Wang
2026-03-20 15:00 ` Stefan Hajnoczi
2026-03-23 1:58 ` Li Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox