[Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

[Alexey Kuznetsov]

Ack

On Fri, Sep 4, 2026 at 10:11 AM Liu Kui <kui.liu at virtuozzo.com> wrote:
>
> In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
> only after the header chunk has been set up. If mapping the header chunk
> fails, the error path calls kreq_release_data_chunks() with an uninitialized
> counter value, so it walks garbage chunk entries, triggering the "Invalid
> chunk type" warning and potentially freeing the wrong memory .
>
> Fix this by resetting the counter before the first error exit.
>
> https://virtuozzo.atlassian.net/browse/VSTOR-143521
>
> Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
> ---
>  fs/fuse/kio/pcs/pcs_krpc.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/fs/fuse/kio/pcs/pcs_krpc.c b/fs/fuse/kio/pcs/pcs_krpc.c
> index 0930fb4adf12..fc7bddf6bb97 100644
> --- a/fs/fuse/kio/pcs/pcs_krpc.c
> +++ b/fs/fuse/kio/pcs/pcs_krpc.c
> @@ -499,6 +499,10 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
>                 kreq->data_chunks = &kreq->inline_data_chunks[0];
>         }
>
> +       kreq->data_len = 0;
> +       kreq->nr_data_chunks = 0;
> +       kreq->nr_data_bvecs = 0;
> +
>         /*
>          * Header buff is exactly one page, used for staging message header. Will be used for
>          * receiving header of response message as well.
> @@ -523,9 +527,6 @@ static int kreq_make_sendmsg(struct krpc_req *kreq)
>         kreq->hdr_kv.iov_len = chunk->len;
>
>         /* data chunk buf descriptors are placed at end of header buf, grow backwards */
> -       kreq->data_len = 0;
> -       kreq->nr_data_chunks = 0;
> -       kreq->nr_data_bvecs = 0;
>
>         chunk_bd = (struct pcs_krpc_buf_desc *)(kreq->hdr_buf + PAGE_SIZE) - 1;
>         chunk = kreq->data_chunks;
> --
> 2.50.1 (Apple Git-155)