Messages in this thread |  | | From | Matt Ochs <> | | Subject | Re: [PATCH] fuse: do not treat unlimited readdir count as a buffer size | | Date | Tue, 28 Apr 2026 22:36:46 +0000 |
| |
> On Apr 28, 2026, at 08:11, Miklos Szeredi <miklos@szeredi.hu> wrote: > > On Tue, 28 Apr 2026 at 04:13, Matthew R. Ochs <mochs@nvidia.com> wrote: > >> For virtiofs, the output kvec is included in the request bounce buffer >> allocated by copy_args_to_argbuf(): >> >> req->argbuf = kmalloc(len, GFP_ATOMIC); > > Ugh. The real bug here is inappropriate use of the bounce buffer. > fuse_readdir_uncached() should instead supply an array of pages. > > It's a little more complicated, but would fix this properly: overlayfs > does want to get as much of the directory as possible in one go to be > most efficient. > > I'd go with vmalloc -> alloc_pages_bulk, then vm_map_ram() before > parsing the result. >
Thanks, that makes sense. I reworked the fix along those lines: uncached readdir now supplies output pages via out_pages and uses vm_map_ram() only for the existing parser.
Testing also showed that the request size needs to be capped by fc->max_write as well as fc->max_pages. fc->max_pages is a page-count limit, and with a 4K host / 64K guest virtiofsd advertised 124 pages, which the guest turned into an ~8 MiB READDIR. virtiofsd's byte-sized payload limit was 1 MiB, so the page-backed version still failed until the fc->max_write cap was added.
I’ll send out a v2 shortly.
-matt
|  |