From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Mon, 17 Aug 2026 12:22:19 +0200 Subject: [Devel] [PATCH RHEL10 COMMIT] fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort In-Reply-To: <20260817092149.56883-1-kui.liu@virtuozzo.com> Message-ID: <202608171022.67HAMJFa346197@f0.sw.ru> List-Id: The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git after rh10-6.12.0-211.39.1.16.5.vz10 ------> commit 24280c870d771554d12f3cbecb0cc40614e45118 Author: Liu Kui Date: Mon Aug 17 17:21:49 2026 +0800 fs/fuse kio: don't touch sio in pcs_sockio_xmit() after connection abort pcs_sockio_xmit() calls pcs_sockio_recv() and then unconditionally pcs_sockio_send() on the same sio. If recv hits a socket error, it calls sio_abort(), which leads to call_rcu(sio_destroy_rcu). Since pcs_sockio_xmit() is not inside an RCU read-side critical section, so the grace period may elapse and sio may be freed before (or while) pcs_sockio_send() dereferences it, a narrow use-after-free window. rpc_abort() clears ep->conn under ep->mutex before destructing the ioconn, and pcs_sockio_xmit() runs under the same mutex, so recheck ep->conn after recv and skip the send if the connection is gone. Fixes: ab1e41eebdec ("fuse kio: Fix rpc socket leak on rpc_abort()") https://virtuozzo.atlassian.net/browse/VSTOR-141422 Feature: vStorage Signed-off-by: Liu Kui Acked-by: Alexey Kuznetsov --- fs/fuse/kio/pcs/pcs_sock_io.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/fuse/kio/pcs/pcs_sock_io.c b/fs/fuse/kio/pcs/pcs_sock_io.c index 47ddc8a7072d3..d1f1560db6d2a 100644 --- a/fs/fuse/kio/pcs/pcs_sock_io.c +++ b/fs/fuse/kio/pcs/pcs_sock_io.c @@ -458,7 +458,14 @@ static void pcs_sockio_xmit(struct pcs_netio *netio) sio->flags &= ~(PCS_SOCK_F_POOLOUT|PCS_SOCK_F_POOLIN); pcs_sockio_recv(sio); - pcs_sockio_send(sio); + + /* pcs_sockio_recv() may abort the connection: sio_abort() -> eof -> rpc_abort(), + * which resets ep->conn and then destructs sio (freed after an RCU grace period + * we are not part of). ep->conn is reset under ep->mutex, which we hold, so + * recheck it before touching sio again. + */ + if (likely(ep->conn)) + pcs_sockio_send(sio); } static int pcs_sockio_flush(struct pcs_netio *netio)