[Devel] [PATCH VZ10] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort

[Devel] [PATCH VZ10] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort

[Liu Kui]

pcs_sockio_xmit() calls pcs_sockio_recv() and then unconditionally
pcs_sockio_send() on the same sio. If recv hits a socket error, it
calls sio_abort(), which leads to call_rcu(sio_destroy_rcu). Since
pcs_sockio_xmit() is not inside an RCU read-side critical section,
so the grace period may elapse and sio may be freed before (or while)
pcs_sockio_send() dereferences it, a narrow use-after-free window.

rpc_abort() clears ep->conn under ep->mutex before destructing the
ioconn, and pcs_sockio_xmit() runs under the same mutex, so recheck
ep->conn after recv and skip the send if the connection is gone.

https://virtuozzo.atlassian.net/browse/VSTOR-141422

Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_sock_io.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c
index 47ddc8a7072d..d1f1560db6d2 100644
--- a/fs/fuse/kio/pcs/pcs_sock_io.c
+++ b/fs/fuse/kio/pcs/pcs_sock_io.c
@@ -458,7 +458,14 @@ static void pcs_sockio_xmit(struct pcs_netio *netio)
 
 	sio->flags &= ~(PCS_SOCK_F_POOLOUT|PCS_SOCK_F_POOLIN);
 	pcs_sockio_recv(sio);
-	pcs_sockio_send(sio);
+
+	/* pcs_sockio_recv() may abort the connection: sio_abort() -> eof -> rpc_abort(),
+	 * which resets ep->conn and then destructs sio (freed after an RCU grace period
+	 * we are not part of). ep->conn is reset under ep->mutex, which we hold, so
+	 * recheck it before touching sio again.
+	 */
+	if (likely(ep->conn))
+		pcs_sockio_send(sio);
 }
 
 static int pcs_sockio_flush(struct pcs_netio *netio)
-- 
2.50.1 (Apple Git-155)

Re: [Devel] [PATCH VZ10] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort

[Alexey Kuznetsov]

Ack

On Mon, Aug 17, 2026 at 5:26?PM Liu Kui <kui.liu@virtuozzo.com> wrote:
>
> pcs_sockio_xmit() calls pcs_sockio_recv() and then unconditionally
> pcs_sockio_send() on the same sio. If recv hits a socket error, it
> calls sio_abort(), which leads to call_rcu(sio_destroy_rcu). Since
> pcs_sockio_xmit() is not inside an RCU read-side critical section,
> so the grace period may elapse and sio may be freed before (or while)
> pcs_sockio_send() dereferences it, a narrow use-after-free window.
>
> rpc_abort() clears ep->conn under ep->mutex before destructing the
> ioconn, and pcs_sockio_xmit() runs under the same mutex, so recheck
> ep->conn after recv and skip the send if the connection is gone.
>
> https://virtuozzo.atlassian.net/browse/VSTOR-141422
>
> Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
> ---
>  fs/fuse/kio/pcs/pcs_sock_io.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c
> index 47ddc8a7072d..d1f1560db6d2 100644
> --- a/fs/fuse/kio/pcs/pcs_sock_io.c
> +++ b/fs/fuse/kio/pcs/pcs_sock_io.c
> @@ -458,7 +458,14 @@ static void pcs_sockio_xmit(struct pcs_netio *netio)
>
>         sio->flags &= ~(PCS_SOCK_F_POOLOUT|PCS_SOCK_F_POOLIN);
>         pcs_sockio_recv(sio);
> -       pcs_sockio_send(sio);
> +
> +       /* pcs_sockio_recv() may abort the connection: sio_abort() -> eof -> rpc_abort(),
> +        * which resets ep->conn and then destructs sio (freed after an RCU grace period
> +        * we are not part of). ep->conn is reset under ep->mutex, which we hold, so
> +        * recheck it before touching sio again.
> +        */
> +       if (likely(ep->conn))
> +               pcs_sockio_send(sio);
>  }
>
>  static int pcs_sockio_flush(struct pcs_netio *netio)
> --
> 2.50.1 (Apple Git-155)

[Devel] [PATCH RHEL10 COMMIT] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.39.1.16.5.vz10
------>
commit 24280c870d771554d12f3cbecb0cc40614e45118
Author: Liu Kui <kui.liu@virtuozzo.com>
Date:   Mon Aug 17 17:21:49 2026 +0800

    fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort
    
    pcs_sockio_xmit() calls pcs_sockio_recv() and then unconditionally
    pcs_sockio_send() on the same sio. If recv hits a socket error, it
    calls sio_abort(), which leads to call_rcu(sio_destroy_rcu).
    
    Since pcs_sockio_xmit() is not inside an RCU read-side critical section,
    so the grace period may elapse and sio may be freed before (or while)
    pcs_sockio_send() dereferences it, a narrow use-after-free window.
    
    rpc_abort() clears ep->conn under ep->mutex before destructing the
    ioconn, and pcs_sockio_xmit() runs under the same mutex, so recheck
    ep->conn after recv and skip the send if the connection is gone.
    
    Fixes: ab1e41eebdec ("fuse kio: Fix rpc socket leak on rpc_abort()")
    https://virtuozzo.atlassian.net/browse/VSTOR-141422
    Feature: vStorage
    Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
    Acked-by: Alexey Kuznetsov <kuznet@virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_sock_io.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c
index 47ddc8a7072d3..d1f1560db6d2a 100644
--- a/fs/fuse/kio/pcs/pcs_sock_io.c
+++ b/fs/fuse/kio/pcs/pcs_sock_io.c
@@ -458,7 +458,14 @@ static void pcs_sockio_xmit(struct pcs_netio *netio)
 
 	sio->flags &= ~(PCS_SOCK_F_POOLOUT|PCS_SOCK_F_POOLIN);
 	pcs_sockio_recv(sio);
-	pcs_sockio_send(sio);
+
+	/* pcs_sockio_recv() may abort the connection: sio_abort() -> eof -> rpc_abort(),
+	 * which resets ep->conn and then destructs sio (freed after an RCU grace period
+	 * we are not part of). ep->conn is reset under ep->mutex, which we hold, so
+	 * recheck it before touching sio again.
+	 */
+	if (likely(ep->conn))
+		pcs_sockio_send(sio);
 }
 
 static int pcs_sockio_flush(struct pcs_netio *netio)