From: Konstantin Khorenko <khorenko@virtuozzo.com>
To: Liu Kui <kui.liu@virtuozzo.com>,
Alexey Kuznetsov <kuznet@virtuozzo.com>,
Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: devel@openvz.org
Subject: [Devel] [PATCH vz10 v4] fs/fuse: sanity check inode type in fuse_invalidate_files()
Date: Mon, 28 Sep 2026 16:29:38 +0200 [thread overview]
Message-ID: <20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-v4-1-cb7cacc4ca45@virtuozzo.com> (raw)
Refuse anything but regular files so the interface can't be
misused: fi->page_waitq is only initialised for those.
https://virtuozzo.atlassian.net/browse/VSTOR-147641
Fixes: 19dd5fa442ea ("fuse: skip waiting for fuse writeback")
Feature: vStorage
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
---
Changes in v4:
- commit message fully rewritten, many thsnk to Liu
- Link to v3: http://lore.virtuozzo.com/20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-v3-1-43a1c1d0ebee@virtuozzo.com
Changes in v3:
- fix the Fixes: tag. eab013c7511c is the hash "fuse: skip waiting for
fuse writeback" has on branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz; the
rebase to 211.52.1.22 renumbered it to 19dd5fa442ea
- drop the claim that an unprivileged fuse server can trigger this: the
notification now takes a close_wait mount, so the sender is vstorage
- drop the account of how the bug was found
- add the reproducer and the note about the selftest above
- Link to v2: http://lore.virtuozzo.com/20260819160529.490608-1-khorenko@virtuozzo.com
- Link to v1: http://lore.virtuozzo.com/20260706110002.1024515-3-khorenko@virtuozzo.com
The patch itself is unchanged since v2.
---
fs/fuse/inode.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index eb2e9a4f87564..025984980c65f 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -667,6 +667,16 @@ int fuse_invalidate_files(struct fuse_dev *fud, u64 nodeid)
if (!inode)
return -ENOENT;
+ /*
+ * fuse_inval_files_work() wakes fi->page_waitq, which is initialised
+ * for regular files only - for other inode types it is not a
+ * waitqueue at all.
+ */
+ if (!S_ISREG(inode->i_mode)) {
+ iput(inode);
+ return -EOPNOTSUPP;
+ }
+
fi = get_fuse_inode(inode);
/*
---
base-commit: ca54f152160587a74ff17cb52feef16f7b9d4e2b
change-id: 20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-213ca0da419a
Best regards,
--
Konstantin Khorenko <khorenko@virtuozzo.com>
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
next reply other threads:[~2026-09-28 14:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-28 14:29 Konstantin Khorenko [this message]
2026-09-28 14:44 ` Konstantin Khorenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-v4-1-cb7cacc4ca45@virtuozzo.com \
--to=khorenko@virtuozzo.com \
--cc=devel@openvz.org \
--cc=kui.liu@virtuozzo.com \
--cc=kuznet@virtuozzo.com \
--cc=ptikhomirov@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox