From 4c72635f913850512d5fa74bf3eb7db3670398cf Mon Sep 17 00:00:00 2001 From: Joanne Koong Date: Thu, 3 Sep 2026 21:56:50 -0700 Subject: [PATCH] fuse: don't shorten the folio descriptor at LLONG_MAX fuse_send_readpages() and fuse_do_readfolio() both decrement the folio descriptor length when handling the overflow case where a read would exceed LLONG_MAX after incrementing the file position by the number of bytes that need to be read in. Shortening it is unnecessary (and for the virtio-fs paths, a bug), and with fuse using iomap for handling reads, shortening it is buggy. For fuse_send_readpages(), ap->descs[] is also what fuse_readpages_end() reports back to iomap_finish_folio_read(). iomap accounted the full length when the range was submitted, so the lengths reported on completion have to add up to what was submitted. Reporting one byte less leaves ifs->read_bytes_pending nonzero, folio_end_read() is never called, and the folio stays locked. This is currently reachable on fuseblk mounts configured with block sizes smaller than the page size. Fix this by leaving the descriptor length untouched. The reply will then be one byte shorter than what the descriptor lengths add up to, and the last byte will be zeroed in fuse_copy_folios(). This also fixes a bug in virtio-fs that existed before any iomap changes were added to fuse. For virtio-fs, data there arrives by DMA rather than through fuse_copy_folios(), so the only zeroing is in virtio_fs_request_complete(), which compares the reply size against the descriptor length. With the descriptor length shortened, the two are equal and nothing gets zeroed, which means the unrequested byte is left holding whatever was in the folio, when the folio is marked uptodate. This is both in the fuse_do_readfolio() and fuse_send_readpages() paths. This dates back to commit 2f1398291bf3 ("fuse: don't overflow LLONG_MAX with end offset"). Fixes: 4ea907108a5c ("fuse: use iomap for readahead") Reported-by: Sashiko Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi --- fs/fuse/file.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 4bdf5dec2cb9..3bf7cb590538 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -864,18 +864,29 @@ static int fuse_do_readfolio(struct file *file, struct folio *folio, attr_ver = fuse_get_attr_version(fm->fc); - /* Don't overflow end offset */ - if (pos + (desc.length - 1) == LLONG_MAX) - desc.length--; + /* + * Don't overflow end offset. + * + * Ask the server for len - 1 bytes. desc.length still holds the full + * length. When the reply comes back, it will be one byte shorter than + * desc.length and fuse_copy_folios() will zero that last byte. + * + * For this reason, desc.length must not be decremented too. The caller + * reports the full length to iomap_finish_folio_read(), which marks + * every block it covers uptodate. Shortening the descriptor would + * suppress zeroing and leave the last byte holding stale data. + */ + if (pos + (len - 1) == LLONG_MAX) + len--; - fuse_read_args_fill(&ia, file, pos, desc.length, FUSE_READ); + fuse_read_args_fill(&ia, file, pos, len, FUSE_READ); res = fuse_simple_request(fm, &ia.ap.args); if (res < 0) return res; /* * Short read means EOF. If file size is larger, truncate it */ - if (res < desc.length) + if (res < len) fuse_short_read(inode, attr_ver, res, &ia.ap); return 0; @@ -1068,11 +1079,20 @@ static void fuse_send_readpages(struct fuse_io_args *ia, struct file *file, ap->args.page_zeroing = true; ap->args.page_replace = true; - /* Don't overflow end offset */ - if (pos + (count - 1) == LLONG_MAX) { + /* + * Don't overflow end offset. + * + * Ask the server for count - 1 bytes. The reply is then one byte + * shorter than what the descriptor lengths add up to, so + * fuse_copy_folios() zeroes the last byte when it walks the folios. + * + * ap->descs[] must not be decremented here. It is what + * fuse_readpages_end() reports back to iomap_finish_folio_read(), and + * iomap has already accounted the full descriptor length, so shortening + * it would leave ifs->read_bytes_pending nonzero and the folio locked. + */ + if (pos + (count - 1) == LLONG_MAX) count--; - ap->descs[ap->num_folios - 1].length--; - } WARN_ON((loff_t) (pos + count) < 0); fuse_read_args_fill(ia, file, pos, count, FUSE_READ);