42
6
Fork
You've already forked steve
1

Do not pass an invalid buffer to FUSE in steve_handle_cuse() #3

Manually merged
mgorny merged 1 commit from flow/steve:fix-memleak-v2 into main 2026年05月23日 08:22:24 +02:00
Member
Copy link

When steve is stopped and the CUSE connection closes,
fuse_session_recieve_buf() returns 0. In thise case
steve_handle_cuse() shuts down the event loop but did not return,
causing an invalid buffer being passed to fuse_session_process_buf().

This causes FUSE to abort, bypassing a clean unmount, which manifests
as a memory leak.

Signed-off-by: Florian Schmaus flow@gentoo.org

When steve is stopped and the CUSE connection closes, fuse_session_recieve_buf() returns 0. In thise case steve_handle_cuse() shuts down the event loop but did not return, causing an invalid buffer being passed to fuse_session_process_buf(). This causes FUSE to abort, bypassing a clean unmount, which manifests as a memory leak. Signed-off-by: Florian Schmaus <flow@gentoo.org>
src/steve.cxx Outdated
@ -1005,2 +1005,4 @@
exit(1);
}
return;
Owner
Copy link

Hmm, this is needed only after event_base_loopbreak(), is that correct? Now I'm wondering if it's okay to be calling fuse_session_process_buf() on EINTR and EAGAIN.

Hmm, this is needed only after `event_base_loopbreak()`, is that correct? Now I'm wondering if it's okay to be calling `fuse_session_process_buf()` on `EINTR` and `EAGAIN`.
Author
Member
Copy link

I think you are right, this is a second bug. We only should invoke event_base_loopbreak() if rd != -EINTR && rd != -EAGAIN. But in any case, we should return and not invoke fuse_session_process_buf().

I think you are right, this is a second bug. We only should invoke `event_base_loopbreak()` if `rd != -EINTR && rd != -EAGAIN`. But in any case, we should `return` and not invoke `fuse_session_process_buf()`.
Owner
Copy link

But if it's the case, then the simpler solution is to invoke it only if rd > 0, right? Then you could if (rd > 0) ... else if (rd != ...) ...

But if it's the case, then the simpler solution is to invoke it only if `rd > 0`, right? Then you could `if (rd > 0) ... else if (rd != ...) ...`
Author
Member
Copy link

Correct, pushed a new version.

Correct, pushed a new version.

Merged as 47dd499c0c

Merged as 47dd499c0c8b6ea7c1a9c3ebf465b436b785b612
mgorny manually merged commit 47dd499c0c into main 2026年05月23日 08:22:24 +02:00
Sign in to join this conversation.
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
gentoo/steve!3
Reference in a new issue
gentoo/steve
No description provided.
Delete branch "flow/steve:fix-memleak-v2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?