Re: [PATCH v8 1/2] fuse: don't BUG when the copy buffer is exhausted
From: Miklos Szeredi
Date: Fri Sep 25 2026 - 11:11:56 EST
On Fri, 11 Sept 2026 at 01:51, Xiang Mei <xmei5@xxxxxxx> wrote:
>
> fuse_copy_fill() hits BUG_ON(!err) once the iterator backing the copy
> runs out of pages. Over io-uring the amount copied is not bounded by the
> payload buffer the server registered, so an unprivileged user can drain
> the iterator and panic the host - mount a FUSE filesystem with small
> payload buffers, then setxattr() a larger value:
Applied series, thanks.
Miklos