Re: [Devel] [PATCH hci-8.0] fs/fuse: fix fuse file refcount leak on close_wait writeback

[Konstantin Khorenko <khorenko@virtuozzo.com>]

  Reverting to the old model brings back its latent defect.

  The defect. An aux request takes two fields from different files:

  - write.in.fh and args->ff are filled from the ff at fill time (fs/fuse/file.c:2791, fs/fuse/file.c:1478).
  - The reference taken at promotion is on the primary request's ff (fs/fuse/file.c:2377).

  While the aux sits in the chain, it holds no reference on its fill-time ff. With close_wait this means fuse_release of
  that file passes its wait_event and frees the ff.

  Scenario:

  1. ffA writes a page, the primary wpa holds a reference on ffA.
  2. ffA is closed, fuse_release blocks in wait_event, ffA is removed from write_files.
  3. ffB writes the same page and ends up as an aux with args->ff = ffB and ffB's fh.
  4. ffB is closed. The aux holds no reference, so release passes, FUSE_RELEASE is sent, ffB is freed.
  5. The primary completes, the aux is promoted with a reference on ffA and goes out.

  Consequences at step 5:

  - fuse_request_queue_background dereferences the already freed ffB (fs/fuse/dev.c:663).
  - The request goes out with an fh userspace has already released.

  Status. This is pre-existing vz9 behaviour, the patch does not introduce it. But the mainline model, where every wpa holds
  a reference on the ff whose fh it uses, closed it as a side effect. This patch takes that away.

  An alternative of roughly the same size fixes both bugs:

  - Keep the mainline model: the reference is taken when the wpa is allocated.
  - Drop the put from fuse_writepage_finish.
  - In fuse_writepage_free call fuse_release_ff(wpa->inode, wpa->ia.ff). It already does the close_wait split with wake_up
    under fi->lock.

  All three fuse_writepage_free callers run without fi->lock, so this fits without reordering anything.
  You mention this option yourself in the "Note:", so this is not something new,

  the question is - are we ok to revert to the old ms scheme without that global rework?

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 9/22/26 15:53, Liu Kui wrote:
> Mainline commit 4046d3adcca4 ("fuse: move fuse file initialization to
> wpa allocation time") moved acquisition of the wpa's fuse file
> reference from submit time (fuse_writepages_send) to wpa allocation
> time, and compensated by dropping the reference unconditionally in
> fuse_writepage_free().
> 
> This breaks the close_wait accounting in the vz tree, which splits the
> drop between two functions: fuse_writepage_finish() does
> __fuse_file_put() for close_wait (allowing fuse_release() to pass
> wait_event(ff->count == 1)), while fuse_writepage_free() puts the
> reference only for !close_wait. This split requires that every wpa
> owning a reference passes through fuse_writepage_finish() before being
> freed. Two paths free a wpa without calling it:
> 
>   - fuse_writepage_add(): temp page swap case frees the new wpa
>   - fuse_send_writepage(): out_free path frees the aux request chain
> 
> Before that commit these paths only ever saw wpas with ia.ff == NULL
> (never submitted or promoted), so nothing leaked. After it, every wpa
> owns a reference from birth, and on close_wait mounts both paths leak
> it: ff->count never returns to 1, fuse_release() hangs forever in
> wait_event(), and the fuse file and its FUSE_RELEASE are leaked.
> 
> Fix it by reverting to the old ownership model for the writeback path:
> a wpa is allocated with ia.ff = NULL and acquires the reference at
> submit time (fuse_writepages_send, fuse_writepage_locked) or at aux
> promotion time (fuse_writepage_end). Also make fuse_writepage_free()
> derive fuse_conn from wpa->inode since ia.ff may now legitimately be
> NULL there.
> 
> Note: this is effectively a revert of the mainline change for the
> writeback path. It can be restored later on a rework of the close_wait
> accounting (e.g. dropping the finish/free split in favour of an
> unconditional put).
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-145614
> 
> Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
> ---
> Fix a fuse file refcount leak on close_wait mounts introduced by the
> rebase to mainline commit 4046d3adcca4 ("fuse: move fuse file
> initialization to wpa allocation time"): wpas freed without going
> through fuse_writepage_finish() (aux temp-page swap, killed aux chains)
> now own a reference nobody drops, so fuse_release() hangs forever in
> wait_event(ff->count == 1). Restore the old ownership model (reference
> acquired at submit/promotion time) for the writeback path.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-145614
> ---
>  fs/fuse/file.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/fuse/file.c b/fs/fuse/file.c
> index 180f60fc539a..50d3f8186d39 100644
> --- a/fs/fuse/file.c
> +++ b/fs/fuse/file.c
> @@ -2181,7 +2181,7 @@ static ssize_t fuse_splice_write(struct pipe_inode_info *pipe, struct file *out,
>  static void fuse_writepage_free(struct fuse_writepage_args *wpa)
>  {
>  	struct fuse_args_pages *ap = &wpa->ia.ap;
> -	struct fuse_conn *fc = wpa->ia.ff->fm->fc;
> +	struct fuse_conn *fc = get_fuse_conn(wpa->inode);
>  	int i;
>  
>  	if (wpa->bucket)
> @@ -2374,6 +2374,7 @@ static void fuse_writepage_end(struct fuse_mount *fm, struct fuse_args *args,
>  
>  		wpa->next = next->next;
>  		next->next = NULL;
> +		next->ia.ff = fuse_file_get(wpa->ia.ff);
>  		tree_insert(&fi->writepages, next);
>  
>  		/*
> @@ -2523,7 +2524,7 @@ static struct fuse_writepage_args *fuse_writepage_args_setup(struct folio *folio
>  	fuse_write_args_fill(&wpa->ia, ff, inode, folio_pos(folio), 0);
>  	wpa->ia.write.in.write_flags |= FUSE_WRITE_CACHE;
>  	wpa->inode = inode;
> -	wpa->ia.ff = ff;
> +	wpa->ia.ff = NULL;
>  
>  	ap = &wpa->ia.ap;
>  	ap->args.in_pages = true;
> @@ -2561,6 +2562,7 @@ static int fuse_writepage_locked(struct folio *folio)
>  	if (!wpa)
>  		goto err_writepage_args;
>  
> +	wpa->ia.ff = ff;
>  	ap = &wpa->ia.ap;
>  	ap->num_pages = 1;
>  
> @@ -2628,6 +2630,7 @@ static void fuse_writepages_send(struct fuse_fill_wb_data *data)
>  	int num_pages = wpa->ia.ap.num_pages;
>  	int i;
>  
> +	wpa->ia.ff = fuse_file_get(data->ff);
>  	spin_lock(&fi->lock);
>  	list_add_tail(&wpa->queue_entry, &fi->queued_writes);
>  	fuse_flush_writepages(inode);
> @@ -2791,7 +2794,6 @@ static int fuse_writepages_fill(struct folio *folio,
>  			folio_redirty_for_writepage(wbc, folio);
>  			goto out_unlock;
>  		}
> -		fuse_file_get(wpa->ia.ff);
>  		data->max_pages = 1;
>  		ap = &wpa->ia.ap;
>  
> 
> ---
> base-commit: 978369605ab89b48b86d12af9f8dda88689ed5ca
> change-id: 20260922-vstor-145614-10a4ac579905
> 
> Best regards,
> --  
> Liu Kui <kui.liu@virtuozzo.com>
> 

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel