From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id CB6478015B for ; Tue, 22 Sep 2026 13:55:35 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MDsHbK018808; Tue, 22 Sep 2026 16:54:18 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MDsHbK018808 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="AQWPoyK5" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68MDsGN9018804 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 22 Sep 2026 16:54:16 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68MDsGN9018804 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-4870ee5618aso2724255f8f.1 for ; Tue, 22 Sep 2026 06:54:16 -0700 (PDT) X-Gm-Message-State: AFuF++kuzKocOoTFyM422AcnoymyabgOQBV0VWyWT4Zlk9auCvbvTMlr K/Zi/HtDCgLdX9bv4q68C1vcyRaH+JRqLnK8m2wwv7Xf+ypeuL2AXaWDaNxKyrR5lm9qYkHUiwm 7K+9KAeFeLzye6sh3CTYyXLbhoXWyp1aF4KRS1Xc1md459wvh/Z7TAw== X-Gm-Gg: AYBFou16hOMBaYdJPF7dG7K2/W5iDgimPgr/QDM3PI407SMcTQV/MZNGPylRisaw5VG gJfbO+8sz7sTzGvpIVpLoQtu8YgCVVtSptBhJF8T5R8AstjP9SfvRAiKqnvOSMK3hUzrRYmAaJg BGUirlVvVVaMNhnge8f1cEmbLLPrMoAMNtKXc6Y973d0yC5qJdmFx9jpUoJcdriiGY+iZPY4ZMh XRr/j3jt37LnJr3FCnVKi3kZMdrG7oJSsRTanki3toWjIVG16p4wTQJiP5THKqTUyWqXIpDbuFK ix2x7yi6VqCub8oioQrd/VCaJK8cEqAo7mV9Onlb1afgfrL+KoYfnkLuQlryFgY+n/cueFropdY jlfj6Uslfs9wlR3d/ X-Received: by 2002:a05:6000:4381:b0:487:27f6:a4d2 with SMTP id ffacd0b85a97d-48727f6a6e1mr14077643f8f.34.1790085255940; Tue, 22 Sep 2026 06:54:15 -0700 (PDT) X-Received: by 2002:a05:6000:4381:b0:487:27f6:a4d2 with SMTP id ffacd0b85a97d-48727f6a6e1mr14077616f8f.34.1790085255391; Tue, 22 Sep 2026 06:54:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790085255; cv=none; d=google.com; s=arc-20260327; b=bXhxzRLuOrTyrAHbKZa4ATbgg9GSzHHxjOPSMFFvwkDEexM0wBGuGSdZjTiUhUK6ba KWSFjfDJdiGbumE91C033zKDQbEZmwWeZM+aK1APUhvjsMYCkbAcHN6SEUi504Bdb8JD NfE0rhldp1xGebDEXbpwKFRMJ4xxRxzA1ORR9l5AAlYCcI6jDDMmHPS1zdVf+Z6/9u1g WsPPUgiKbp8j467HmBH8kIaEvzuzzvPtv2aolay+uhC4HUMQ84aYZ7ZMTSiMYMNfNOGk Wqhnu70gkdDOstcuuc4bArO1YBZbBUwZ1PtWJapGIq32Gcpo6vsMAXPQUzcrkgOWrT5h pLPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=3HaBRJgkdhMm6SNI64zLfUYOEHHqeNivj5irJBO2tf8=; fh=6JpqpGxFeFNaDh+k4t2UfZyo3rKe/54dyQ52T8vVmSc=; b=YG9LqM7ZXlqFLEYzeiC2CSdV85f7HVmmxO9vKxc6DuhOqJLe59AKkCjI5btlZFQXiF J2ibLaFif1IqKGIx72dv1sg74uzzalTG3fMpEn/l17PM19kHyUnrjEphl7gChyYZNQbl LMqGuDUjSM/aunwv3XTsYwH36C/b5NG8rQJKgcgd6OPViC6S/tXQloMxKCgQoBolTemT etnv8rerQfa2XFm0ZkcP5kihf0BkEY8XejayScaFmPFh2M7iHMAye/54wCBpce6HoNUv d1X8txRzjD1N+hFvFx0bbUBNqHs+asOlZMJyHEwxk7Vz0RS9pcyAyPHs/pnZGJ/ro9Gj q5bg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=AQWPoyK5; spf=pass (google.com: domain of kui.liu@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=kui.liu@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-488628e33f1si3373242f8f.413.2026.09.22.06.54.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Sep 2026 06:54:15 -0700 (PDT) Received-SPF: pass (google.com: domain of kui.liu@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=AQWPoyK5; spf=pass (google.com: domain of kui.liu@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=kui.liu@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=3HaBRJgkdhMm6SNI64zLfUYOEHHqeNivj5irJBO2tf8=; b=AQWPoyK5Yg3wcYjF47n yY46a6o2sq5BvcdY35Pe5j3KEbMX8gY1KMj5SY9rQRDx3WAUhLAJSjG+rPJ9weYQnSUY0Fgk+R8++ EdwjIqvZx8eex4LvKj7xxLSRY9QQFpRoEHBLfIm5lbAthJMd57KOAG6NGE0YOFzaero6QvI1N9eEY m4kA1jD6w2s3Uc9mx5IgzhNBgF0QL6Hw4/Dgo58sFxv59Znf8HPCz4F9lyc/nLae9r1dLtW9eUODf Kqj1GfwZ6tKMksY+y1rx8JfkB2sqCXp5t5QXbafpFJ1NZq6YHVJ6MfaO6dl2mQ6gVcvdq8Jc5Xmp5 Y4YX8FbWPYc/46Q==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LK-MBP.local) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x90tu-00BvE1-1x; Tue, 22 Sep 2026 15:54:05 +0200 From: Liu Kui Date: Tue, 22 Sep 2026 21:53:40 +0800 MIME-Version: 1.0 Message-Id: <20260922-vstor-145614-v1-1-e14dd025e85a@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/yWMQQ6CMBAAv0L27JJt04L1K8RDrQusBzBdJCSEv 1P1OJnM7KCchRVu1Q6ZV1GZpwLmUkEa4zQwyrMwWLINBWtx1WXOaJxvjEND0cXk2xDIQ0nemXv ZfrsOxiR4rQnuf6Gfx4vT8p3BcZxyr7hweQAAAA== X-Change-ID: 20260922-vstor-145614-10a4ac579905 To: Konstantin Khorenko X-Mailer: b4 0.16.0 X-OZ-Fwd: true Cc: azaitsev@virtuozzo.com, devel@openvz.org, Liu Kui Subject: [Devel] [PATCH hci-8.0] fs/fuse: fix fuse file refcount leak on close_wait writeback X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org Mainline commit 4046d3adcca4 ("fuse: move fuse file initialization to wpa allocation time") moved acquisition of the wpa's fuse file reference from submit time (fuse_writepages_send) to wpa allocation time, and compensated by dropping the reference unconditionally in fuse_writepage_free(). This breaks the close_wait accounting in the vz tree, which splits the drop between two functions: fuse_writepage_finish() does __fuse_file_put() for close_wait (allowing fuse_release() to pass wait_event(ff->count == 1)), while fuse_writepage_free() puts the reference only for !close_wait. This split requires that every wpa owning a reference passes through fuse_writepage_finish() before being freed. Two paths free a wpa without calling it: - fuse_writepage_add(): temp page swap case frees the new wpa - fuse_send_writepage(): out_free path frees the aux request chain Before that commit these paths only ever saw wpas with ia.ff == NULL (never submitted or promoted), so nothing leaked. After it, every wpa owns a reference from birth, and on close_wait mounts both paths leak it: ff->count never returns to 1, fuse_release() hangs forever in wait_event(), and the fuse file and its FUSE_RELEASE are leaked. Fix it by reverting to the old ownership model for the writeback path: a wpa is allocated with ia.ff = NULL and acquires the reference at submit time (fuse_writepages_send, fuse_writepage_locked) or at aux promotion time (fuse_writepage_end). Also make fuse_writepage_free() derive fuse_conn from wpa->inode since ia.ff may now legitimately be NULL there. Note: this is effectively a revert of the mainline change for the writeback path. It can be restored later on a rework of the close_wait accounting (e.g. dropping the finish/free split in favour of an unconditional put). https://virtuozzo.atlassian.net/browse/VSTOR-145614 Signed-off-by: Liu Kui --- Fix a fuse file refcount leak on close_wait mounts introduced by the rebase to mainline commit 4046d3adcca4 ("fuse: move fuse file initialization to wpa allocation time"): wpas freed without going through fuse_writepage_finish() (aux temp-page swap, killed aux chains) now own a reference nobody drops, so fuse_release() hangs forever in wait_event(ff->count == 1). Restore the old ownership model (reference acquired at submit/promotion time) for the writeback path. https://virtuozzo.atlassian.net/browse/VSTOR-145614 --- fs/fuse/file.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 180f60fc539a..50d3f8186d39 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -2181,7 +2181,7 @@ static ssize_t fuse_splice_write(struct pipe_inode_info *pipe, struct file *out, static void fuse_writepage_free(struct fuse_writepage_args *wpa) { struct fuse_args_pages *ap = &wpa->ia.ap; - struct fuse_conn *fc = wpa->ia.ff->fm->fc; + struct fuse_conn *fc = get_fuse_conn(wpa->inode); int i; if (wpa->bucket) @@ -2374,6 +2374,7 @@ static void fuse_writepage_end(struct fuse_mount *fm, struct fuse_args *args, wpa->next = next->next; next->next = NULL; + next->ia.ff = fuse_file_get(wpa->ia.ff); tree_insert(&fi->writepages, next); /* @@ -2523,7 +2524,7 @@ static struct fuse_writepage_args *fuse_writepage_args_setup(struct folio *folio fuse_write_args_fill(&wpa->ia, ff, inode, folio_pos(folio), 0); wpa->ia.write.in.write_flags |= FUSE_WRITE_CACHE; wpa->inode = inode; - wpa->ia.ff = ff; + wpa->ia.ff = NULL; ap = &wpa->ia.ap; ap->args.in_pages = true; @@ -2561,6 +2562,7 @@ static int fuse_writepage_locked(struct folio *folio) if (!wpa) goto err_writepage_args; + wpa->ia.ff = ff; ap = &wpa->ia.ap; ap->num_pages = 1; @@ -2628,6 +2630,7 @@ static void fuse_writepages_send(struct fuse_fill_wb_data *data) int num_pages = wpa->ia.ap.num_pages; int i; + wpa->ia.ff = fuse_file_get(data->ff); spin_lock(&fi->lock); list_add_tail(&wpa->queue_entry, &fi->queued_writes); fuse_flush_writepages(inode); @@ -2791,7 +2794,6 @@ static int fuse_writepages_fill(struct folio *folio, folio_redirty_for_writepage(wbc, folio); goto out_unlock; } - fuse_file_get(wpa->ia.ff); data->max_pages = 1; ap = &wpa->ia.ap; --- base-commit: 978369605ab89b48b86d12af9f8dda88689ed5ca change-id: 20260922-vstor-145614-10a4ac579905 Best regards, -- Liu Kui _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel