Unverified Commit c3880a7b authored by Junxi Qian's avatar Junxi Qian Committed by Christian Brauner
Browse files

fuse: fix writeback array overflow when max_pages is one 



fuse_iomap_writeback_range() appends one folio pointer and one
fuse_folio_desc for every dirty range that is merged into the current
writeback request.  The merge decision checks the byte budget against
fc->max_pages and fc->max_write, but it does not check whether the folio
and descriptor arrays still have another free slot.

This is not sufficient for fuseblk, where the filesystem block size can
be smaller than PAGE_SIZE.  With writeback cache enabled and max_pages
negotiated as one, contiguous sub-page dirty ranges can fit within the
byte budget while spanning more than one folio.  The next append can then
write past the one-slot folios and descs arrays.

Split the request when the number of already attached folios has reached
fc->max_pages.  This keeps the folio/descriptor slot accounting in sync
with the send decision.

Fixes: ef7e7cbb ("fuse: use iomap for writeback")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarJoanne Koong <joannelkoong@gmail.com>
Signed-off-by: default avatarJunxi Qian <qjx1298677004@gmail.com>
Link: https://patch.msgid.link/20260506122415.205340-1-qjx1298677004@gmail.com


Acked-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent a7cf1da7

fs/fuse/file.c

+4 −1
Original line number Diff line number Diff line
@@ -2176,7 +2176,10 @@ static bool fuse_folios_need_send(struct fuse_conn *fc, loff_t pos, 


	WARN_ON(!ap->num_folios);



	/* Reached max pages */

	/* Reached max pages or max folio slots */

	if (ap->num_folios >= fc->max_pages)

		return true;



	if (DIV_ROUND_UP(bytes, PAGE_SIZE) > fc->max_pages)

		return true;