Re: [PATCH v2] virtiofs: validate fixed-output response length

[sashiko-bot@kernel.org]

> A short successful virtiofs response can leave the fixed-output
> portion of the request argument buffer unwritten. The completion path
> nevertheless copies the full declared output to the request destination,
> allowing stale allocator contents to reach callers such as
> fuse_statfs().
> 
> Require successful fixed-output responses to contain their complete
> declared output. Continue to permit a shorter final argument only for
> out_argvar requests. Reject positive and internal restart error values,
> require valid error replies to be header-only, and do not copy output
> arguments from error replies.
> 
> A header-only FUSE_STATFS success returned stale fields in nine of
> nine calls across three boots. The fixed kernel rejected the short
> response and preserved complete replies, valid error replies, and
> variable-output controls.
> 
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <tjdqudcks0424@naver.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006182408.1301152-1-tjdqudcks0424@naver.com?part=1