lkml.org 
[lkml]   [2026]   [Apr]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] fuse: do not treat unlimited readdir count as a buffer size
Date
> On Apr 28, 2026, at 08:11, Miklos Szeredi <miklos@szeredi.hu> wrote:
>
> On Tue, 28 Apr 2026 at 04:13, Matthew R. Ochs <mochs@nvidia.com> wrote:
>
>> For virtiofs, the output kvec is included in the request bounce buffer
>> allocated by copy_args_to_argbuf():
>>
>> req->argbuf = kmalloc(len, GFP_ATOMIC);
>
> Ugh. The real bug here is inappropriate use of the bounce buffer.
> fuse_readdir_uncached() should instead supply an array of pages.
>
> It's a little more complicated, but would fix this properly: overlayfs
> does want to get as much of the directory as possible in one go to be
> most efficient.
>
> I'd go with vmalloc -> alloc_pages_bulk, then vm_map_ram() before
> parsing the result.
>

Thanks, that makes sense. I reworked the fix along those lines: uncached
readdir now supplies output pages via out_pages and uses vm_map_ram() only
for the existing parser.

Testing also showed that the request size needs to be capped by
fc->max_write as well as fc->max_pages. fc->max_pages is a page-count
limit, and with a 4K host / 64K guest virtiofsd advertised 124 pages,
which the guest turned into an ~8 MiB READDIR. virtiofsd's byte-sized
payload limit was 1 MiB, so the page-backed version still failed until the
fc->max_write cap was added.

I’ll send out a v2 shortly.


-matt

\
 
 \ /
  Last update: 2026-04-29 00:37    [W:0.114 / U:9.965 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog