kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/fs/fuse
History
Joanne Koong cbbf3f1bb9 fuse: fix readahead reclaim deadlock 
[ Upstream commit bd5603eaae ]

Commit e26ee4efbc ("fuse: allocate ff->release_args only if release is
needed") skips allocating ff->release_args if the server does not
implement open. However in doing so, fuse_prepare_release() now skips
grabbing the reference on the inode, which makes it possible for an
inode to be evicted from the dcache while there are inflight readahead
requests. This causes a deadlock if the server triggers reclaim while
servicing the readahead request and reclaim attempts to evict the inode
of the file being read ahead. Since the folio is locked during
readahead, when reclaim evicts the fuse inode and fuse_evict_inode()
attempts to remove all folios associated with the inode from the page
cache (truncate_inode_pages_range()), reclaim will block forever waiting
for the lock since readahead cannot relinquish the lock because it is
itself blocked in reclaim:

>>> stack_trace(1504735)
 folio_wait_bit_common (mm/filemap.c:1308:4)
 folio_lock (./include/linux/pagemap.h:1052:3)
 truncate_inode_pages_range (mm/truncate.c:336:10)
 fuse_evict_inode (fs/fuse/inode.c:161:2)
 evict (fs/inode.c:704:3)
 dentry_unlink_inode (fs/dcache.c:412:3)
 __dentry_kill (fs/dcache.c:615:3)
 shrink_kill (fs/dcache.c:1060:12)
 shrink_dentry_list (fs/dcache.c:1087:3)
 prune_dcache_sb (fs/dcache.c:1168:2)
 super_cache_scan (fs/super.c:221:10)
 do_shrink_slab (mm/shrinker.c:435:9)
 shrink_slab (mm/shrinker.c:626:10)
 shrink_node (mm/vmscan.c:5951:2)
 shrink_zones (mm/vmscan.c:6195:3)
 do_try_to_free_pages (mm/vmscan.c:6257:3)
 do_swap_page (mm/memory.c:4136:11)
 handle_pte_fault (mm/memory.c:5562:10)
 handle_mm_fault (mm/memory.c:5870:9)
 do_user_addr_fault (arch/x86/mm/fault.c:1338:10)
 handle_page_fault (arch/x86/mm/fault.c:1481:3)
 exc_page_fault (arch/x86/mm/fault.c:1539:2)
 asm_exc_page_fault+0x22/0x27

Fix this deadlock by allocating ff->release_args and grabbing the
reference on the inode when preparing the file for release even if the
server does not implement open. The inode reference will be dropped when
the last reference on the fuse file is dropped (see fuse_file_put() ->
fuse_release_end()).

Fixes: e26ee4efbc ("fuse: allocate ff->release_args only if release is needed")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reported-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:10:08 +01:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
control.c fuse: Remove the control interface for virtio-fs 2022-08-17 14:24:11 +02:00
cuse.c fuse: fix UAF in rcu pathwalks 2024-09-04 13:23:23 +02:00
dax.c fuse: fix dax truncate/punch_hole fault path 2025-04-10 14:32:02 +02:00
dev.c fuse: Initialize beyond-EOF page contents before setting uptodate 2024-09-04 13:23:14 +02:00
dir.c fuse: allocate ff->release_args only if release is needed 2025-10-29 14:03:14 +01:00
file.c fuse: fix readahead reclaim deadlock 2026-01-19 13:10:08 +01:00
fuse_i.h fuse: allocate ff->release_args only if release is needed 2025-10-29 14:03:14 +01:00
inode.c fuse: fix UAF in rcu pathwalks 2024-09-04 13:23:23 +02:00
ioctl.c fuse: ioctl: translate ENOSYS in outarg 2023-07-27 08:46:54 +02:00
Kconfig virtiofs: implement dax read/write operations 2020-09-10 11:39:23 +02:00
Makefile fuse: move ioctl to separate source file 2021-04-12 15:04:30 +02:00
readdir.c fuse: nlookup missing decrement in fuse_direntplus_link 2023-09-19 12:23:01 +02:00
virtio_fs.c virtiofs: add filesystem context source name check 2025-05-02 07:44:14 +02:00
xattr.c fuse: use unsigned type for getxattr/listxattr size truncation 2024-09-12 11:07:44 +02:00