From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexey Kuznetsov Date: Mon, 17 Aug 2026 17:41:08 +0800 Subject: Re: [Devel] [PATCH VZ10] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort In-Reply-To: <20260817092149.56883-1-kui.liu@virtuozzo.com> References: <20260817092149.56883-1-kui.liu@virtuozzo.com> Message-ID: List-Id: Ack On Mon, Aug 17, 2026 at 5:26?PM Liu Kui wrote: > > pcs_sockio_xmit() calls pcs_sockio_recv() and then unconditionally > pcs_sockio_send() on the same sio. If recv hits a socket error, it > calls sio_abort(), which leads to call_rcu(sio_destroy_rcu). Since > pcs_sockio_xmit() is not inside an RCU read-side critical section, > so the grace period may elapse and sio may be freed before (or while) > pcs_sockio_send() dereferences it, a narrow use-after-free window. > > rpc_abort() clears ep->conn under ep->mutex before destructing the > ioconn, and pcs_sockio_xmit() runs under the same mutex, so recheck > ep->conn after recv and skip the send if the connection is gone. > > https://virtuozzo.atlassian.net/browse/VSTOR-141422 > > Signed-off-by: Liu Kui > --- > fs/fuse/kio/pcs/pcs_sock_io.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c > index 47ddc8a7072d..d1f1560db6d2 100644 > --- a/fs/fuse/kio/pcs/pcs_sock_io.c > +++ b/fs/fuse/kio/pcs/pcs_sock_io.c > @@ -458,7 +458,14 @@ static void pcs_sockio_xmit(struct pcs_netio *netio) > > sio->flags &= ~(PCS_SOCK_F_POOLOUT|PCS_SOCK_F_POOLIN); > pcs_sockio_recv(sio); > - pcs_sockio_send(sio); > + > + /* pcs_sockio_recv() may abort the connection: sio_abort() -> eof -> rpc_abort(), > + * which resets ep->conn and then destructs sio (freed after an RCU grace period > + * we are not part of). ep->conn is reset under ep->mutex, which we hold, so > + * recheck it before touching sio again. > + */ > + if (likely(ep->conn)) > + pcs_sockio_send(sio); > } > > static int pcs_sockio_flush(struct pcs_netio *netio) > -- > 2.50.1 (Apple Git-155)