Hi Stefan,
On 20/03/2026 23:00, Stefan Hajnoczi wrote:
> On Wed, Mar 18, 2026 at 10:58 PM Li Wang <[email protected]> wrote:
>>
>> Verify that server properly follows FUSE protocol, by checking
>> oh.uniq and oh.len.
>>
>> Signed-off-by: Li Wang <[email protected]>
>> ---
>> fs/fuse/virtio_fs.c | 27 ++++++++++++++++++++++++++-
>> 1 file changed, 26 insertions(+), 1 deletion(-)
>
> Earlier patch series addressing this:
> - https://lore.kernel.org/all/[email protected]/
> - https://lore.kernel.org/all/[email protected]/
>
> The second one was applied and I think your version conflicts with it.
>
> Please take a look and let us know whether you want to drop your patch
> or send a v2 rebased on Miklos latest tree
> (https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git).
>
Thanks for the review, and I will submit a V2 to address your feedback.
Thanks,
Li
> Thanks,
> Stefan
>
>>
>> diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
>> index 057e65b51b99..c30f6f58664c 100644
>> --- a/fs/fuse/virtio_fs.c
>> +++ b/fs/fuse/virtio_fs.c
>> @@ -768,10 +768,34 @@ static void virtio_fs_request_complete(struct fuse_req
>> *req,
>> struct folio *folio;
>>
>> /*
>> - * TODO verify that server properly follows FUSE protocol
>> + * Verify that server properly follows FUSE protocol
>> * (oh.uniq, oh.len)
>> */
>> args = req->args;
>> + if (test_bit(FR_ISREPLY, &req->flags)) {
>> + struct fuse_out_header *oh = &req->out.h;
>> +
>> + if (unlikely(oh->unique != req->in.h.unique)) {
>> + pr_warn_ratelimited("virtio-fs: bad reply unique
>> %llu (expected %llu)\n",
>> + oh->unique, req->in.h.unique);
>> + oh->error = -EIO;
>> + oh->len = sizeof(*oh);
>> + goto out;
>> + }
>> + unsigned int num_out = args->out_numargs - args->out_pages;
>> + unsigned int cap = sizeof(req->out.h);
>> +
>> + cap += fuse_len_args(num_out, args->out_args);
>> + if (args->out_pages)
>> + cap += args->out_args[args->out_numargs - 1].size;
>> + if (unlikely(oh->len < sizeof(*oh) || oh->len > cap)) {
>> + pr_warn_ratelimited("virtio-fs: bad reply len %u
>> (cap %u)\n",
>> + oh->len, cap);
>> + oh->error = -EIO;
>> + oh->len = sizeof(*oh);
>> + goto out;
>> + }
>> + }
>> copy_args_from_argbuf(args, req);
>>
>> if (args->out_pages && args->page_zeroing) {
>> @@ -790,6 +814,7 @@ static void virtio_fs_request_complete(struct fuse_req
>> *req,
>> }
>> }
>>
>> +out:
>> clear_bit(FR_SENT, &req->flags);
>>
>> fuse_request_end(req);
>> --
>> 2.34.1
>>
>>
