On Tue, Aug 18, 2026 at 5:28 AM Miklos Szeredi <[email protected]> wrote: > > On Tue, 28 Jul 2026 at 01:37, Xiang Mei <[email protected]> wrote: > > > Store the registered payload length (payload->iov_len) in the ring entry > > and use it for the import and both bounds checks, so the buffer the > > server provided is honoured and an oversized reply/request is rejected > > (-EINVAL for a reply, and -E2BIG/-EIO for a request, matching > > fuse_dev_do_read()) instead of panicking. > > Can you please update this on latest fuse.git#for-next? It looks like > some of the checks are already added by Joanne's patches. > Thanks for your help merging 1/3. I checked the latest version finding there is some changes to these functions but the check is still missing and we can still trigger the bug so I rebased the fix and dropped the review-by tag. V6 has been sent for your review:
https://lore.kernel.org/fuse-devel/[email protected]/T/#t Thanks, Xiang > Thanks, > Miklos
