yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-virtiofsd-check-input-buffer-size-in-fuse_lowlevel.c.patch

ddf19c
From d6a0067e6c08523a8f605f775be980eaf0a23690 Mon Sep 17 00:00:00 2001
ddf19c
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
ddf19c
Date: Mon, 27 Jan 2020 19:01:23 +0100
ddf19c
Subject: [PATCH 052/116] virtiofsd: check input buffer size in fuse_lowlevel.c
ddf19c
 ops
ddf19c
MIME-Version: 1.0
ddf19c
Content-Type: text/plain; charset=UTF-8
ddf19c
Content-Transfer-Encoding: 8bit
ddf19c
ddf19c
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
ddf19c
Message-id: <20200127190227.40942-49-dgilbert@redhat.com>
ddf19c
Patchwork-id: 93503
ddf19c
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 048/112] virtiofsd: check input buffer size in fuse_lowlevel.c ops
ddf19c
Bugzilla: 1694164
ddf19c
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
ddf19c
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
ddf19c
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
ddf19c
ddf19c
From: Stefan Hajnoczi <stefanha@redhat.com>
ddf19c
ddf19c
Each FUSE operation involves parsing the input buffer.  Currently the
ddf19c
code assumes the input buffer is large enough for the expected
ddf19c
arguments.  This patch uses fuse_mbuf_iter to check the size.
ddf19c
ddf19c
Most operations are simple to convert.  Some are more complicated due to
ddf19c
variable-length inputs or different sizes depending on the protocol
ddf19c
version.
ddf19c
ddf19c
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
ddf19c
Reviewed-by: Sergio Lopez <slp@redhat.com>
ddf19c
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
ddf19c
(cherry picked from commit 70995754416eb4491c31607fe380a83cfd25a087)
ddf19c
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
ddf19c
---
ddf19c
 tools/virtiofsd/fuse_lowlevel.c | 581 +++++++++++++++++++++++++++++++---------
ddf19c
 1 file changed, 456 insertions(+), 125 deletions(-)
ddf19c
ddf19c
diff --git a/tools/virtiofsd/fuse_lowlevel.c b/tools/virtiofsd/fuse_lowlevel.c
ddf19c
index 611e8b0..02e1d83 100644
ddf19c
--- a/tools/virtiofsd/fuse_lowlevel.c
ddf19c
+++ b/tools/virtiofsd/fuse_lowlevel.c
ddf19c
@@ -19,6 +19,7 @@
ddf19c
 #include <assert.h>
ddf19c
 #include <errno.h>
ddf19c
 #include <limits.h>
ddf19c
+#include <stdbool.h>
ddf19c
 #include <stddef.h>
ddf19c
 #include <stdio.h>
ddf19c
 #include <stdlib.h>
ddf19c
@@ -27,7 +28,6 @@
ddf19c
 #include <unistd.h>
ddf19c
 
ddf19c
 
ddf19c
-#define PARAM(inarg) (((char *)(inarg)) + sizeof(*(inarg)))
ddf19c
 #define OFFSET_MAX 0x7fffffffffffffffLL
ddf19c
 
ddf19c
 struct fuse_pollhandle {
ddf19c
@@ -706,9 +706,14 @@ int fuse_reply_lseek(fuse_req_t req, off_t off)
ddf19c
     return send_reply_ok(req, &arg, sizeof(arg));
ddf19c
 }
ddf19c
 
ddf19c
-static void do_lookup(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_lookup(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    char *name = (char *)inarg;
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.lookup) {
ddf19c
         req->se->op.lookup(req, nodeid, name);
ddf19c
@@ -717,9 +722,16 @@ static void do_lookup(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_forget(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_forget(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_forget_in *arg = (struct fuse_forget_in *)inarg;
ddf19c
+    struct fuse_forget_in *arg;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.forget) {
ddf19c
         req->se->op.forget(req, nodeid, arg->nlookup);
ddf19c
@@ -729,20 +741,48 @@ static void do_forget(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
 }
ddf19c
 
ddf19c
 static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
-                            const void *inarg)
ddf19c
+                            struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_batch_forget_in *arg = (void *)inarg;
ddf19c
-    struct fuse_forget_one *param = (void *)PARAM(arg);
ddf19c
-    unsigned int i;
ddf19c
+    struct fuse_batch_forget_in *arg;
ddf19c
+    struct fuse_forget_data *forgets;
ddf19c
+    size_t scount;
ddf19c
 
ddf19c
     (void)nodeid;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_none(req);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    /*
ddf19c
+     * Prevent integer overflow.  The compiler emits the following warning
ddf19c
+     * unless we use the scount local variable:
ddf19c
+     *
ddf19c
+     * error: comparison is always false due to limited range of data type
ddf19c
+     * [-Werror=type-limits]
ddf19c
+     *
ddf19c
+     * This may be true on 64-bit hosts but we need this check for 32-bit
ddf19c
+     * hosts.
ddf19c
+     */
ddf19c
+    scount = arg->count;
ddf19c
+    if (scount > SIZE_MAX / sizeof(forgets[0])) {
ddf19c
+        fuse_reply_none(req);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    forgets = fuse_mbuf_iter_advance(iter, arg->count * sizeof(forgets[0]));
ddf19c
+    if (!forgets) {
ddf19c
+        fuse_reply_none(req);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     if (req->se->op.forget_multi) {
ddf19c
-        req->se->op.forget_multi(req, arg->count,
ddf19c
-                                 (struct fuse_forget_data *)param);
ddf19c
+        req->se->op.forget_multi(req, arg->count, forgets);
ddf19c
     } else if (req->se->op.forget) {
ddf19c
+        unsigned int i;
ddf19c
+
ddf19c
         for (i = 0; i < arg->count; i++) {
ddf19c
-            struct fuse_forget_one *forget = &param[i];
ddf19c
             struct fuse_req *dummy_req;
ddf19c
 
ddf19c
             dummy_req = fuse_ll_alloc_req(req->se);
ddf19c
@@ -754,7 +794,7 @@ static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
             dummy_req->ctx = req->ctx;
ddf19c
             dummy_req->ch = NULL;
ddf19c
 
ddf19c
-            req->se->op.forget(dummy_req, forget->nodeid, forget->nlookup);
ddf19c
+            req->se->op.forget(dummy_req, forgets[i].ino, forgets[i].nlookup);
ddf19c
         }
ddf19c
         fuse_reply_none(req);
ddf19c
     } else {
ddf19c
@@ -762,12 +802,19 @@ static void do_batch_forget(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_getattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_getattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
     struct fuse_file_info *fip = NULL;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
-    struct fuse_getattr_in *arg = (struct fuse_getattr_in *)inarg;
ddf19c
+    struct fuse_getattr_in *arg;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (arg->getattr_flags & FUSE_GETATTR_FH) {
ddf19c
         memset(&fi, 0, sizeof(fi));
ddf19c
@@ -782,14 +829,21 @@ static void do_getattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_setattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_setattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_setattr_in *arg = (struct fuse_setattr_in *)inarg;
ddf19c
-
ddf19c
     if (req->se->op.setattr) {
ddf19c
+        struct fuse_setattr_in *arg;
ddf19c
         struct fuse_file_info *fi = NULL;
ddf19c
         struct fuse_file_info fi_store;
ddf19c
         struct stat stbuf;
ddf19c
+
ddf19c
+        arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+        if (!arg) {
ddf19c
+            fuse_reply_err(req, EINVAL);
ddf19c
+            return;
ddf19c
+        }
ddf19c
+
ddf19c
         memset(&stbuf, 0, sizeof(stbuf));
ddf19c
         convert_attr(arg, &stbuf);
ddf19c
         if (arg->valid & FATTR_FH) {
ddf19c
@@ -810,9 +864,16 @@ static void do_setattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_access(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_access(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_access_in *arg = (struct fuse_access_in *)inarg;
ddf19c
+    struct fuse_access_in *arg;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.access) {
ddf19c
         req->se->op.access(req, nodeid, arg->mask);
ddf19c
@@ -821,9 +882,10 @@ static void do_access(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_readlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_readlink(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                        struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    (void)inarg;
ddf19c
+    (void)iter;
ddf19c
 
ddf19c
     if (req->se->op.readlink) {
ddf19c
         req->se->op.readlink(req, nodeid);
ddf19c
@@ -832,10 +894,18 @@ static void do_readlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_mknod(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_mknod(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_mknod_in *arg = (struct fuse_mknod_in *)inarg;
ddf19c
-    char *name = PARAM(arg);
ddf19c
+    struct fuse_mknod_in *arg;
ddf19c
+    const char *name;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     req->ctx.umask = arg->umask;
ddf19c
 
ddf19c
@@ -846,22 +916,37 @@ static void do_mknod(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_mkdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_mkdir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_mkdir_in *arg = (struct fuse_mkdir_in *)inarg;
ddf19c
+    struct fuse_mkdir_in *arg;
ddf19c
+    const char *name;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     req->ctx.umask = arg->umask;
ddf19c
 
ddf19c
     if (req->se->op.mkdir) {
ddf19c
-        req->se->op.mkdir(req, nodeid, PARAM(arg), arg->mode);
ddf19c
+        req->se->op.mkdir(req, nodeid, name, arg->mode);
ddf19c
     } else {
ddf19c
         fuse_reply_err(req, ENOSYS);
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_unlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_unlink(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    char *name = (char *)inarg;
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+
ddf19c
+    if (!name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.unlink) {
ddf19c
         req->se->op.unlink(req, nodeid, name);
ddf19c
@@ -870,9 +955,15 @@ static void do_unlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    char *name = (char *)inarg;
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+
ddf19c
+    if (!name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.rmdir) {
ddf19c
         req->se->op.rmdir(req, nodeid, name);
ddf19c
@@ -881,10 +972,16 @@ static void do_rmdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_symlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_symlink(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    char *name = (char *)inarg;
ddf19c
-    char *linkname = ((char *)inarg) + strlen((char *)inarg) + 1;
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    const char *linkname = fuse_mbuf_iter_advance_str(iter);
ddf19c
+
ddf19c
+    if (!name || !linkname) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.symlink) {
ddf19c
         req->se->op.symlink(req, linkname, nodeid, name);
ddf19c
@@ -893,11 +990,20 @@ static void do_symlink(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_rename(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_rename(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_rename_in *arg = (struct fuse_rename_in *)inarg;
ddf19c
-    char *oldname = PARAM(arg);
ddf19c
-    char *newname = oldname + strlen(oldname) + 1;
ddf19c
+    struct fuse_rename_in *arg;
ddf19c
+    const char *oldname;
ddf19c
+    const char *newname;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    oldname = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    newname = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !oldname || !newname) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.rename) {
ddf19c
         req->se->op.rename(req, nodeid, oldname, arg->newdir, newname, 0);
ddf19c
@@ -906,11 +1012,20 @@ static void do_rename(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_rename2(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_rename2(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_rename2_in *arg = (struct fuse_rename2_in *)inarg;
ddf19c
-    char *oldname = PARAM(arg);
ddf19c
-    char *newname = oldname + strlen(oldname) + 1;
ddf19c
+    struct fuse_rename2_in *arg;
ddf19c
+    const char *oldname;
ddf19c
+    const char *newname;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    oldname = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    newname = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !oldname || !newname) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.rename) {
ddf19c
         req->se->op.rename(req, nodeid, oldname, arg->newdir, newname,
ddf19c
@@ -920,24 +1035,38 @@ static void do_rename2(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_link(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_link(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_link_in *arg = (struct fuse_link_in *)inarg;
ddf19c
+    struct fuse_link_in *arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+
ddf19c
+    if (!arg || !name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.link) {
ddf19c
-        req->se->op.link(req, arg->oldnodeid, nodeid, PARAM(arg));
ddf19c
+        req->se->op.link(req, arg->oldnodeid, nodeid, name);
ddf19c
     } else {
ddf19c
         fuse_reply_err(req, ENOSYS);
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_create(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_create(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_create_in *arg = (struct fuse_create_in *)inarg;
ddf19c
-
ddf19c
     if (req->se->op.create) {
ddf19c
+        struct fuse_create_in *arg;
ddf19c
         struct fuse_file_info fi;
ddf19c
-        char *name = PARAM(arg);
ddf19c
+        const char *name;
ddf19c
+
ddf19c
+        arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+        name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+        if (!arg || !name) {
ddf19c
+            fuse_reply_err(req, EINVAL);
ddf19c
+            return;
ddf19c
+        }
ddf19c
 
ddf19c
         memset(&fi, 0, sizeof(fi));
ddf19c
         fi.flags = arg->flags;
ddf19c
@@ -950,11 +1079,18 @@ static void do_create(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_open(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_open(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_open_in *arg = (struct fuse_open_in *)inarg;
ddf19c
+    struct fuse_open_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.flags = arg->flags;
ddf19c
 
ddf19c
@@ -965,13 +1101,15 @@ static void do_open(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_read(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_read(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_read_in *arg = (struct fuse_read_in *)inarg;
ddf19c
-
ddf19c
     if (req->se->op.read) {
ddf19c
+        struct fuse_read_in *arg;
ddf19c
         struct fuse_file_info fi;
ddf19c
 
ddf19c
+        arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+
ddf19c
         memset(&fi, 0, sizeof(fi));
ddf19c
         fi.fh = arg->fh;
ddf19c
         fi.lock_owner = arg->lock_owner;
ddf19c
@@ -982,11 +1120,24 @@ static void do_read(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_write(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_write(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_write_in *arg = (struct fuse_write_in *)inarg;
ddf19c
+    struct fuse_write_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
-    char *param;
ddf19c
+    const char *param;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    param = fuse_mbuf_iter_advance(iter, arg->size);
ddf19c
+    if (!param) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
@@ -994,7 +1145,6 @@ static void do_write(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
 
ddf19c
     fi.lock_owner = arg->lock_owner;
ddf19c
     fi.flags = arg->flags;
ddf19c
-    param = PARAM(arg);
ddf19c
 
ddf19c
     if (req->se->op.write) {
ddf19c
         req->se->op.write(req, nodeid, param, arg->size, arg->offset, &fi);
ddf19c
@@ -1052,11 +1202,18 @@ static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
     se->op.write_buf(req, nodeid, pbufv, arg->offset, &fi);
ddf19c
 }
ddf19c
 
ddf19c
-static void do_flush(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_flush(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_flush_in *arg = (struct fuse_flush_in *)inarg;
ddf19c
+    struct fuse_flush_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
     fi.flush = 1;
ddf19c
@@ -1069,19 +1226,26 @@ static void do_flush(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_release(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_release(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_release_in *arg = (struct fuse_release_in *)inarg;
ddf19c
+    struct fuse_release_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.flags = arg->flags;
ddf19c
     fi.fh = arg->fh;
ddf19c
     fi.flush = (arg->release_flags & FUSE_RELEASE_FLUSH) ? 1 : 0;
ddf19c
     fi.lock_owner = arg->lock_owner;
ddf19c
+
ddf19c
     if (arg->release_flags & FUSE_RELEASE_FLOCK_UNLOCK) {
ddf19c
         fi.flock_release = 1;
ddf19c
-        fi.lock_owner = arg->lock_owner;
ddf19c
     }
ddf19c
 
ddf19c
     if (req->se->op.release) {
ddf19c
@@ -1091,11 +1255,19 @@ static void do_release(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_fsync(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_fsync(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_fsync_in *arg = (struct fuse_fsync_in *)inarg;
ddf19c
+    struct fuse_fsync_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
-    int datasync = arg->fsync_flags & 1;
ddf19c
+    int datasync;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+    datasync = arg->fsync_flags & 1;
ddf19c
 
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
@@ -1111,11 +1283,18 @@ static void do_fsync(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_opendir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_opendir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_open_in *arg = (struct fuse_open_in *)inarg;
ddf19c
+    struct fuse_open_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.flags = arg->flags;
ddf19c
 
ddf19c
@@ -1126,11 +1305,18 @@ static void do_opendir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_readdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_readdir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_read_in *arg = (struct fuse_read_in *)inarg;
ddf19c
+    struct fuse_read_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
 
ddf19c
@@ -1141,11 +1327,18 @@ static void do_readdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                           struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_read_in *arg = (struct fuse_read_in *)inarg;
ddf19c
+    struct fuse_read_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
 
ddf19c
@@ -1156,11 +1349,18 @@ static void do_readdirplus(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                          struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_release_in *arg = (struct fuse_release_in *)inarg;
ddf19c
+    struct fuse_release_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.flags = arg->flags;
ddf19c
     fi.fh = arg->fh;
ddf19c
@@ -1172,11 +1372,19 @@ static void do_releasedir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                        struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_fsync_in *arg = (struct fuse_fsync_in *)inarg;
ddf19c
+    struct fuse_fsync_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
-    int datasync = arg->fsync_flags & 1;
ddf19c
+    int datasync;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+    datasync = arg->fsync_flags & 1;
ddf19c
 
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
@@ -1188,10 +1396,11 @@ static void do_fsyncdir(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_statfs(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_statfs(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
     (void)nodeid;
ddf19c
-    (void)inarg;
ddf19c
+    (void)iter;
ddf19c
 
ddf19c
     if (req->se->op.statfs) {
ddf19c
         req->se->op.statfs(req, nodeid);
ddf19c
@@ -1204,11 +1413,25 @@ static void do_statfs(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                        struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_setxattr_in *arg = (struct fuse_setxattr_in *)inarg;
ddf19c
-    char *name = PARAM(arg);
ddf19c
-    char *value = name + strlen(name) + 1;
ddf19c
+    struct fuse_setxattr_in *arg;
ddf19c
+    const char *name;
ddf19c
+    const char *value;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    value = fuse_mbuf_iter_advance(iter, arg->size);
ddf19c
+    if (!value) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.setxattr) {
ddf19c
         req->se->op.setxattr(req, nodeid, name, value, arg->size, arg->flags);
ddf19c
@@ -1217,20 +1440,36 @@ static void do_setxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_getxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_getxattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                        struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_getxattr_in *arg = (struct fuse_getxattr_in *)inarg;
ddf19c
+    struct fuse_getxattr_in *arg;
ddf19c
+    const char *name;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+    if (!arg || !name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.getxattr) {
ddf19c
-        req->se->op.getxattr(req, nodeid, PARAM(arg), arg->size);
ddf19c
+        req->se->op.getxattr(req, nodeid, name, arg->size);
ddf19c
     } else {
ddf19c
         fuse_reply_err(req, ENOSYS);
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                         struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_getxattr_in *arg = (struct fuse_getxattr_in *)inarg;
ddf19c
+    struct fuse_getxattr_in *arg;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.listxattr) {
ddf19c
         req->se->op.listxattr(req, nodeid, arg->size);
ddf19c
@@ -1239,9 +1478,15 @@ static void do_listxattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_removexattr(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_removexattr(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                           struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    char *name = (char *)inarg;
ddf19c
+    const char *name = fuse_mbuf_iter_advance_str(iter);
ddf19c
+
ddf19c
+    if (!name) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.removexattr) {
ddf19c
         req->se->op.removexattr(req, nodeid, name);
ddf19c
@@ -1265,12 +1510,19 @@ static void convert_fuse_file_lock(struct fuse_file_lock *fl,
ddf19c
     flock->l_pid = fl->pid;
ddf19c
 }
ddf19c
 
ddf19c
-static void do_getlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_getlk(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_lk_in *arg = (struct fuse_lk_in *)inarg;
ddf19c
+    struct fuse_lk_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
     struct flock flock;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
     fi.lock_owner = arg->owner;
ddf19c
@@ -1284,12 +1536,18 @@ static void do_getlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
 }
ddf19c
 
ddf19c
 static void do_setlk_common(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
-                            const void *inarg, int sleep)
ddf19c
+                            struct fuse_mbuf_iter *iter, int sleep)
ddf19c
 {
ddf19c
-    struct fuse_lk_in *arg = (struct fuse_lk_in *)inarg;
ddf19c
+    struct fuse_lk_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
     struct flock flock;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
     fi.lock_owner = arg->owner;
ddf19c
@@ -1327,14 +1585,16 @@ static void do_setlk_common(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_setlk(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_setlk(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    do_setlk_common(req, nodeid, inarg, 0);
ddf19c
+    do_setlk_common(req, nodeid, iter, 0);
ddf19c
 }
ddf19c
 
ddf19c
-static void do_setlkw(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_setlkw(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                      struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    do_setlk_common(req, nodeid, inarg, 1);
ddf19c
+    do_setlk_common(req, nodeid, iter, 1);
ddf19c
 }
ddf19c
 
ddf19c
 static int find_interrupted(struct fuse_session *se, struct fuse_req *req)
ddf19c
@@ -1379,12 +1639,20 @@ static int find_interrupted(struct fuse_session *se, struct fuse_req *req)
ddf19c
     return 0;
ddf19c
 }
ddf19c
 
ddf19c
-static void do_interrupt(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_interrupt(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                         struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_interrupt_in *arg = (struct fuse_interrupt_in *)inarg;
ddf19c
+    struct fuse_interrupt_in *arg;
ddf19c
     struct fuse_session *se = req->se;
ddf19c
 
ddf19c
     (void)nodeid;
ddf19c
+
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     if (se->debug) {
ddf19c
         fuse_log(FUSE_LOG_DEBUG, "INTERRUPT: %llu\n",
ddf19c
                  (unsigned long long)arg->unique);
ddf19c
@@ -1425,9 +1693,15 @@ static struct fuse_req *check_interrupt(struct fuse_session *se,
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_bmap(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_bmap(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_bmap_in *arg = (struct fuse_bmap_in *)inarg;
ddf19c
+    struct fuse_bmap_in *arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
 
ddf19c
     if (req->se->op.bmap) {
ddf19c
         req->se->op.bmap(req, nodeid, arg->blocksize, arg->block);
ddf19c
@@ -1436,18 +1710,34 @@ static void do_bmap(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_ioctl(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_ioctl(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_ioctl_in *arg = (struct fuse_ioctl_in *)inarg;
ddf19c
-    unsigned int flags = arg->flags;
ddf19c
-    void *in_buf = arg->in_size ? PARAM(arg) : NULL;
ddf19c
+    struct fuse_ioctl_in *arg;
ddf19c
+    unsigned int flags;
ddf19c
+    void *in_buf = NULL;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    flags = arg->flags;
ddf19c
     if (flags & FUSE_IOCTL_DIR && !(req->se->conn.want & FUSE_CAP_IOCTL_DIR)) {
ddf19c
         fuse_reply_err(req, ENOTTY);
ddf19c
         return;
ddf19c
     }
ddf19c
 
ddf19c
+    if (arg->in_size) {
ddf19c
+        in_buf = fuse_mbuf_iter_advance(iter, arg->in_size);
ddf19c
+        if (!in_buf) {
ddf19c
+            fuse_reply_err(req, EINVAL);
ddf19c
+            return;
ddf19c
+        }
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
 
ddf19c
@@ -1468,11 +1758,18 @@ void fuse_pollhandle_destroy(struct fuse_pollhandle *ph)
ddf19c
     free(ph);
ddf19c
 }
ddf19c
 
ddf19c
-static void do_poll(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_poll(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_poll_in *arg = (struct fuse_poll_in *)inarg;
ddf19c
+    struct fuse_poll_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
     fi.poll_events = arg->events;
ddf19c
@@ -1496,11 +1793,18 @@ static void do_poll(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                         struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_fallocate_in *arg = (struct fuse_fallocate_in *)inarg;
ddf19c
+    struct fuse_fallocate_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
 
ddf19c
@@ -1513,12 +1817,17 @@ static void do_fallocate(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
 }
ddf19c
 
ddf19c
 static void do_copy_file_range(fuse_req_t req, fuse_ino_t nodeid_in,
ddf19c
-                               const void *inarg)
ddf19c
+                               struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_copy_file_range_in *arg =
ddf19c
-        (struct fuse_copy_file_range_in *)inarg;
ddf19c
+    struct fuse_copy_file_range_in *arg;
ddf19c
     struct fuse_file_info fi_in, fi_out;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     memset(&fi_in, 0, sizeof(fi_in));
ddf19c
     fi_in.fh = arg->fh_in;
ddf19c
 
ddf19c
@@ -1535,11 +1844,17 @@ static void do_copy_file_range(fuse_req_t req, fuse_ino_t nodeid_in,
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_lseek(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_lseek(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                     struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_lseek_in *arg = (struct fuse_lseek_in *)inarg;
ddf19c
+    struct fuse_lseek_in *arg;
ddf19c
     struct fuse_file_info fi;
ddf19c
 
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, sizeof(*arg));
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
     memset(&fi, 0, sizeof(fi));
ddf19c
     fi.fh = arg->fh;
ddf19c
 
ddf19c
@@ -1550,15 +1865,33 @@ static void do_lseek(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     }
ddf19c
 }
ddf19c
 
ddf19c
-static void do_init(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_init(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                    struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
-    struct fuse_init_in *arg = (struct fuse_init_in *)inarg;
ddf19c
+    size_t compat_size = offsetof(struct fuse_init_in, max_readahead);
ddf19c
+    struct fuse_init_in *arg;
ddf19c
     struct fuse_init_out outarg;
ddf19c
     struct fuse_session *se = req->se;
ddf19c
     size_t bufsize = se->bufsize;
ddf19c
     size_t outargsize = sizeof(outarg);
ddf19c
 
ddf19c
     (void)nodeid;
ddf19c
+
ddf19c
+    /* First consume the old fields... */
ddf19c
+    arg = fuse_mbuf_iter_advance(iter, compat_size);
ddf19c
+    if (!arg) {
ddf19c
+        fuse_reply_err(req, EINVAL);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
+    /* ...and now consume the new fields. */
ddf19c
+    if (arg->major == 7 && arg->minor >= 6) {
ddf19c
+        if (!fuse_mbuf_iter_advance(iter, sizeof(*arg) - compat_size)) {
ddf19c
+            fuse_reply_err(req, EINVAL);
ddf19c
+            return;
ddf19c
+        }
ddf19c
+    }
ddf19c
+
ddf19c
     if (se->debug) {
ddf19c
         fuse_log(FUSE_LOG_DEBUG, "INIT: %u.%u\n", arg->major, arg->minor);
ddf19c
         if (arg->major == 7 && arg->minor >= 6) {
ddf19c
@@ -1791,12 +2124,13 @@ static void do_init(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
     send_reply_ok(req, &outarg, outargsize);
ddf19c
 }
ddf19c
 
ddf19c
-static void do_destroy(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
ddf19c
+static void do_destroy(fuse_req_t req, fuse_ino_t nodeid,
ddf19c
+                       struct fuse_mbuf_iter *iter)
ddf19c
 {
ddf19c
     struct fuse_session *se = req->se;
ddf19c
 
ddf19c
     (void)nodeid;
ddf19c
-    (void)inarg;
ddf19c
+    (void)iter;
ddf19c
 
ddf19c
     se->got_destroy = 1;
ddf19c
     if (se->op.destroy) {
ddf19c
@@ -1976,7 +2310,7 @@ int fuse_req_interrupted(fuse_req_t req)
ddf19c
 }
ddf19c
 
ddf19c
 static struct {
ddf19c
-    void (*func)(fuse_req_t, fuse_ino_t, const void *);
ddf19c
+    void (*func)(fuse_req_t, fuse_ino_t, struct fuse_mbuf_iter *);
ddf19c
     const char *name;
ddf19c
 } fuse_ll_ops[] = {
ddf19c
     [FUSE_LOOKUP] = { do_lookup, "LOOKUP" },
ddf19c
@@ -2060,7 +2394,6 @@ void fuse_session_process_buf_int(struct fuse_session *se,
ddf19c
     const struct fuse_buf *buf = bufv->buf;
ddf19c
     struct fuse_mbuf_iter iter = FUSE_MBUF_ITER_INIT(buf);
ddf19c
     struct fuse_in_header *in;
ddf19c
-    const void *inarg;
ddf19c
     struct fuse_req *req;
ddf19c
     int err;
ddf19c
 
ddf19c
@@ -2138,13 +2471,11 @@ void fuse_session_process_buf_int(struct fuse_session *se,
ddf19c
         }
ddf19c
     }
ddf19c
 
ddf19c
-    inarg = (void *)&in[1];
ddf19c
     if (in->opcode == FUSE_WRITE && se->op.write_buf) {
ddf19c
         do_write_buf(req, in->nodeid, &iter, bufv);
ddf19c
     } else {
ddf19c
-        fuse_ll_ops[in->opcode].func(req, in->nodeid, inarg);
ddf19c
+        fuse_ll_ops[in->opcode].func(req, in->nodeid, &iter);
ddf19c
     }
ddf19c
-
ddf19c
     return;
ddf19c
 
ddf19c
 reply_err:
ddf19c
-- 
ddf19c
1.8.3.1
ddf19c