[Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Liu Kui]

In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
only after the header chunk has been set up. If mapping the header chunk
fails, the error path calls kreq_release_data_chunks() with an uninitialized
counter value, so it walks garbage chunk entries, triggering the "Invalid
chunk type" warning and potentially freeing the wrong memory .

Fix this by resetting the counter before the first error exit.

https://virtuozzo.atlassian.net/browse/VSTOR-143521

Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_krpc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/kio/pcs/pcs_krpc.c b/fs/fuse/kio/pcs/pcs_krpc.c
index 0930fb4adf12..fc7bddf6bb97 100644
--- a/fs/fuse/kio/pcs/pcs_krpc.c
+++ b/fs/fuse/kio/pcs/pcs_krpc.c
@@ -499,6 +499,10 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
 		kreq->data_chunks = &kreq->inline_data_chunks[0];
 	}
 
+	kreq->data_len = 0;
+	kreq->nr_data_chunks = 0;
+	kreq->nr_data_bvecs = 0;
+
 	/*
 	 * Header buff is exactly one page, used for staging message header. Will be used for
 	 * receiving header of response message as well.
@@ -523,9 +527,6 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
 	kreq->hdr_kv.iov_len = chunk->len;
 
 	/* data chunk buf descriptors are placed at end of header buf, grow backwards */
-	kreq->data_len = 0;
-	kreq->nr_data_chunks = 0;
-	kreq->nr_data_bvecs = 0;
 
 	chunk_bd = (struct pcs_krpc_buf_desc *)(kreq->hdr_buf + PAGE_SIZE) - 1;
 	chunk = kreq->data_chunks;
-- 
2.50.1 (Apple Git-155)

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Alexey Kuznetsov]

Ack

On Fri, Sep 4, 2026 at 10:11 AM Liu Kui <kui.liu@virtuozzo.com> wrote:
>
> In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
> only after the header chunk has been set up. If mapping the header chunk
> fails, the error path calls kreq_release_data_chunks() with an uninitialized
> counter value, so it walks garbage chunk entries, triggering the "Invalid
> chunk type" warning and potentially freeing the wrong memory .
>
> Fix this by resetting the counter before the first error exit.
>
> https://virtuozzo.atlassian.net/browse/VSTOR-143521
>
> Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
> ---
>  fs/fuse/kio/pcs/pcs_krpc.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/fuse/kio/pcs/pcs_krpc.c b/fs/fuse/kio/pcs/pcs_krpc.c
> index 0930fb4adf12..fc7bddf6bb97 100644
> --- a/fs/fuse/kio/pcs/pcs_krpc.c
> +++ b/fs/fuse/kio/pcs/pcs_krpc.c
> @@ -499,6 +499,10 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
>                 kreq->data_chunks = &kreq->inline_data_chunks[0];
>         }
>
> +       kreq->data_len = 0;
> +       kreq->nr_data_chunks = 0;
> +       kreq->nr_data_bvecs = 0;
> +
>         /*
>          * Header buff is exactly one page, used for staging message header. Will be used for
>          * receiving header of response message as well.
> @@ -523,9 +527,6 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
>         kreq->hdr_kv.iov_len = chunk->len;
>
>         /* data chunk buf descriptors are placed at end of header buf, grow backwards */
> -       kreq->data_len = 0;
> -       kreq->nr_data_chunks = 0;
> -       kreq->nr_data_bvecs = 0;
>
>         chunk_bd = (struct pcs_krpc_buf_desc *)(kreq->hdr_buf + PAGE_SIZE) - 1;
>         chunk = kreq->data_chunks;
> --
> 2.50.1 (Apple Git-155)

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Konstantin Khorenko]

> In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
> only after the header chunk has been set up. If mapping the header chunk
> fails, the error path calls kreq_release_data_chunks() with an uninitialized
> counter value, so it walks garbage chunk entries, triggering the "Invalid
> chunk type" warning and potentially freeing the wrong memory .
> 
> Fix this by resetting the counter before the first error exit.


Fixes: f9150edc32b7 ("fs/fuse kio: convert BUG_ON check to error handling")
Feature: fuse: kRPC - single RPC for kernel and userspace

> https://virtuozzo.atlassian.net/browse/VSTOR-143521
> 
> Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko <khorenko@virtuozzo.com>
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Konstantin Khorenko]

On Fri, 04 Sep 2026 09:57:33 +0800, Liu Kui wrote:
> fs/fuse kio: fix use of uninitialized data chunk counter on error path

Applied to branch-rh10-6.12.0-211.50.1.18.x.vz10-ovz, will be released in rh10-6.12.0-211.50.1.18.3.vz10, thanks!

[1/1] fs/fuse kio: fix use of uninitialized data chunk counter on error path
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/eaea3ca331c5

-- 
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel