Re: [PATCH v5 2/3] fuse: bound io-uring payload copies to the registered buffer size

Miklos Szeredi <[email protected]>
Newsgroups dev.linux.lists.fuse-devel,org.kernel.vger.linux-hardening,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID <CAJfpegtvYJPBt=AcssH25mn5VDR3Gdkhf1PvuLR5HkJ=CmkYpQ@mail.gmail.com> 
On Tue, 28 Jul 2026 at 01:37, Xiang Mei <[email protected]> wrote:

> Store the registered payload length (payload->iov_len) in the ring entry
> and use it for the import and both bounds checks, so the buffer the
> server provided is honoured and an oversized reply/request is rejected
> (-EINVAL for a reply, and -E2BIG/-EIO for a request, matching
> fuse_dev_do_read()) instead of panicking.

Can you please update this on latest fuse.git#for-next?  It looks like
some of the checks are already added by Joanne's patches.

Thanks,
Miklos
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.