Re: [PATCH v5 2/3] fuse: bound io-uring payload copies to the registered buffer size

[Xiang Mei]

On Tue, Aug 18, 2026 at 5:28 AM Miklos Szeredi <miklos@xxxxxxxxxx> wrote:
>
> On Tue, 28 Jul 2026 at 01:37, Xiang Mei <xmei5@xxxxxxx> wrote:
>
> > Store the registered payload length (payload->iov_len) in the ring entry
> > and use it for the import and both bounds checks, so the buffer the
> > server provided is honoured and an oversized reply/request is rejected
> > (-EINVAL for a reply, and -E2BIG/-EIO for a request, matching
> > fuse_dev_do_read()) instead of panicking.
>
> Can you please update this on latest fuse.git#for-next?  It looks like
> some of the checks are already added by Joanne's patches.
>
Thanks for your help merging 1/3. I checked the latest version finding
there is some changes to these functions but the check is still
missing and we can still trigger the bug so I rebased the fix and
dropped the review-by tag. V6 has been sent for your review:

https://lore.kernel.org/fuse-devel/20260906012924.1928316-1-xmei5@xxxxxxx/T/#t

Thanks,
Xiang

> Thanks,
> Miklos