[Devel] [PATCH VZ10] fs/fuse kio: fix use of uninitialized data chunk counter on error path

Konstantin Khorenko khorenko at virtuozzo.com
Fri Sep 4 14:23:21 MSK 2026


> In kreq_make_sendmsg(), the data chunk counter nr_data_chunks is reset
> only after the header chunk has been set up. If mapping the header chunk
> fails, the error path calls kreq_release_data_chunks() with an uninitialized
> counter value, so it walks garbage chunk entries, triggering the "Invalid
> chunk type" warning and potentially freeing the wrong memory .
> 
> Fix this by resetting the counter before the first error exit.


Fixes: f9150edc32b7 ("fs/fuse kio: convert BUG_ON check to error handling")
Feature: fuse: kRPC - single RPC for kernel and userspace

> https://virtuozzo.atlassian.net/browse/VSTOR-143521
> 
> Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>

Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>

-- 
Konstantin Khorenko <khorenko at virtuozzo.com>


More information about the Devel mailing list