Re: [PATCH] fuse: do not treat unlimited readdir count as a buffer size

[Matt Ochs <mochs@nvidia.com>]

> On Apr 28, 2026, at 08:11, Miklos Szeredi <miklos@szeredi.hu> wrote:
> 
> On Tue, 28 Apr 2026 at 04:13, Matthew R. Ochs <mochs@nvidia.com> wrote:
> 
>> For virtiofs, the output kvec is included in the request bounce buffer
>> allocated by copy_args_to_argbuf():
>> 
>>  req->argbuf = kmalloc(len, GFP_ATOMIC);
> 
> Ugh.   The real bug here is inappropriate use of the bounce buffer.
> fuse_readdir_uncached() should instead supply an array of pages.
> 
> It's a little more complicated, but would fix this properly: overlayfs
> does want to get as much of the directory as possible in one go to be
> most efficient.
> 
> I'd go with vmalloc -> alloc_pages_bulk, then vm_map_ram() before
> parsing the result.
> 

Thanks, that makes sense. I reworked the fix along those lines: uncached
readdir now supplies output pages via out_pages and uses vm_map_ram() only
for the existing parser.

Testing also showed that the request size needs to be capped by
fc->max_write as well as fc->max_pages. fc->max_pages is a page-count
limit, and with a 4K host / 64K guest virtiofsd advertised 124 pages,
which the guest turned into an ~8 MiB READDIR. virtiofsd's byte-sized
payload limit was 1 MiB, so the page-backed version still failed until the
fc->max_write cap was added.

I’ll send out a v2 shortly.


-matt