On Fri, 11 Sept 2026 at 01:51, Xiang Mei <[email protected]> wrote: > > fuse_copy_fill() hits BUG_ON(!err) once the iterator backing the copy > runs out of pages. Over io-uring the amount copied is not bounded by the > payload buffer the server registered, so an unprivileged user can drain > the iterator and panic the host - mount a FUSE filesystem with small > payload buffers, then setxattr() a larger value:
Applied series, thanks. Miklos
