[PATCH v1 28/30] fuse: enforce op header for every payload reply

[Joanne Koong <joannelkoong@gmail.com>]

In order to support fuse io-uring zero-copy, the payload and the headers
for a request/reply must reside in separate buffers since any
zero-copied payload will be transparent to the daemon but the headers
need to be accessible.

Currently, a fuse reply can be either:
* arg[0] = op header, arg[1] = payload
* arg[0] = payload
* arg[0] = NULL

Fuse io-uring needs to differentiate between the first two for copying
to/from the ring.

Enforce that all fuse replies that have a payload also have an op
header. If there is is only a payload to send in the reply, then the
header will be a zero-size no-op header.

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
---
 fs/fuse/dir.c     |  5 +++--
 fs/fuse/file.c    | 11 ++++++-----
 fs/fuse/fuse_i.h  |  6 ++++++
 fs/fuse/readdir.c |  2 +-
 fs/fuse/xattr.c   | 16 ++++++++++------
 5 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index b79be8bbbaf8..238fa1bab3c9 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1630,8 +1630,9 @@ static int fuse_readlink_folio(struct inode *inode, struct folio *folio)
 	ap.args.out_pages = true;
 	ap.args.out_argvar = true;
 	ap.args.page_zeroing = true;
-	ap.args.out_numargs = 1;
-	ap.args.out_args[0].size = desc.length;
+	ap.args.out_numargs = 2;
+	fuse_zero_out_arg0(&ap.args);
+	ap.args.out_args[1].size = desc.length;
 	res = fuse_simple_request(fm, &ap.args);
 
 	fuse_invalidate_atime(inode);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f1ef77a0be05..ff6c287bc4ed 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -581,8 +581,9 @@ void fuse_read_args_fill(struct fuse_io_args *ia, struct file *file, loff_t pos,
 	args->in_args[0].size = sizeof(ia->read.in);
 	args->in_args[0].value = &ia->read.in;
 	args->out_argvar = true;
-	args->out_numargs = 1;
-	args->out_args[0].size = count;
+	args->out_numargs = 2;
+	fuse_zero_out_arg0(args);
+	args->out_args[1].size = count;
 }
 
 static void fuse_release_user_pages(struct fuse_args_pages *ap, ssize_t nres,
@@ -711,7 +712,7 @@ static void fuse_aio_complete_req(struct fuse_mount *fm, struct fuse_args *args,
 				      ia->write.out.size;
 		}
 	} else {
-		u32 outsize = args->out_args[0].size;
+		u32 outsize = args->out_args[1].size;
 
 		nres = outsize;
 		if (ia->read.in.size != outsize)
@@ -870,7 +871,7 @@ static void fuse_readpages_end(struct fuse_mount *fm, struct fuse_args *args,
 	struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args);
 	struct fuse_args_pages *ap = &ia->ap;
 	size_t count = ia->read.in.size;
-	size_t num_read = args->out_args[0].size;
+	size_t num_read = args->out_args[1].size;
 	struct address_space *mapping;
 	struct inode *inode;
 
@@ -1506,7 +1507,7 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii,
 			if (write)
 				ap->args.in_args[1].value = user_addr;
 			else
-				ap->args.out_args[0].value = user_addr;
+				ap->args.out_args[1].value = user_addr;
 
 			iov_iter_advance(ii, frag_size);
 			*nbytesp = frag_size;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 34541801d950..e45126d792a6 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -1026,6 +1026,12 @@ static inline void fuse_zero_in_arg0(struct fuse_args *args)
 	args->in_args[0].value = NULL;
 }
 
+static inline void fuse_zero_out_arg0(struct fuse_args *args)
+{
+	args->out_args[0].size = sizeof(struct fuse_zero_header);
+	args->out_args[0].value = NULL;
+}
+
 static inline struct fuse_mount *get_fuse_mount_super(struct super_block *sb)
 {
 	return sb->s_fs_info;
diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c
index c2aae2eef086..d80cd2bedabe 100644
--- a/fs/fuse/readdir.c
+++ b/fs/fuse/readdir.c
@@ -349,7 +349,7 @@ static int fuse_readdir_uncached(struct file *file, struct dir_context *ctx)
 	if (!buf)
 		return -ENOMEM;
 
-	args->out_args[0].value = buf;
+	args->out_args[1].value = buf;
 
 	plus = fuse_use_readdirplus(inode, ctx);
 	if (plus) {
diff --git a/fs/fuse/xattr.c b/fs/fuse/xattr.c
index aa0881162287..4011a99abd52 100644
--- a/fs/fuse/xattr.c
+++ b/fs/fuse/xattr.c
@@ -70,12 +70,14 @@ ssize_t fuse_getxattr(struct inode *inode, const char *name, void *value,
 	args.in_args[1].size = strlen(name) + 1;
 	args.in_args[1].value = name;
 	/* This is really two different operations rolled into one */
-	args.out_numargs = 1;
 	if (size) {
 		args.out_argvar = true;
-		args.out_args[0].size = size;
-		args.out_args[0].value = value;
+		args.out_numargs = 2;
+		fuse_zero_out_arg0(&args);
+		args.out_args[1].size = size;
+		args.out_args[1].value = value;
 	} else {
+		args.out_numargs = 1;
 		args.out_args[0].size = sizeof(outarg);
 		args.out_args[0].value = &outarg;
 	}
@@ -132,12 +134,14 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
 	args.in_args[0].size = sizeof(inarg);
 	args.in_args[0].value = &inarg;
 	/* This is really two different operations rolled into one */
-	args.out_numargs = 1;
 	if (size) {
 		args.out_argvar = true;
-		args.out_args[0].size = size;
-		args.out_args[0].value = list;
+		args.out_numargs = 2;
+		fuse_zero_out_arg0(&args);
+		args.out_args[1].size = size;
+		args.out_args[1].value = list;
 	} else {
+		args.out_numargs = 1;
 		args.out_args[0].size = sizeof(outarg);
 		args.out_args[0].value = &outarg;
 	}
-- 
2.47.3