[Devel] [PATCH vz10 v4] fs/fuse: sanity check inode type in fuse_invalidate_files()

* [Devel] [PATCH vz10 v4] fs/fuse: sanity check inode type in fuse_invalidate_files()
@ 2026-09-28 14:29 Konstantin Khorenko
  2026-09-28 14:44 ` Konstantin Khorenko
  0 siblings, 1 reply; 2+ messages in thread
From: Konstantin Khorenko @ 2026-09-28 14:29 UTC (permalink / raw)
  To: Liu Kui, Alexey Kuznetsov, Pavel Tikhomirov; +Cc: devel

Refuse anything but regular files so the interface can't be
misused: fi->page_waitq is only initialised for those.

https://virtuozzo.atlassian.net/browse/VSTOR-147641

Fixes: 19dd5fa442ea ("fuse: skip waiting for fuse writeback")
Feature: vStorage
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Liu Kui <kui.liu@virtuozzo.com>
---
Changes in v4:
- commit message fully rewritten, many thsnk to Liu
- Link to v3: http://lore.virtuozzo.com/20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-v3-1-43a1c1d0ebee@virtuozzo.com

Changes in v3:
- fix the Fixes: tag. eab013c7511c is the hash "fuse: skip waiting for
  fuse writeback" has on branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz; the
  rebase to 211.52.1.22 renumbered it to 19dd5fa442ea
- drop the claim that an unprivileged fuse server can trigger this: the
  notification now takes a close_wait mount, so the sender is vstorage
- drop the account of how the bug was found
- add the reproducer and the note about the selftest above
- Link to v2: http://lore.virtuozzo.com/20260819160529.490608-1-khorenko@virtuozzo.com
- Link to v1: http://lore.virtuozzo.com/20260706110002.1024515-3-khorenko@virtuozzo.com

The patch itself is unchanged since v2.
---
 fs/fuse/inode.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index eb2e9a4f87564..025984980c65f 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -667,6 +667,16 @@ int fuse_invalidate_files(struct fuse_dev *fud, u64 nodeid)
 	if (!inode)
 		return -ENOENT;
 
+	/*
+	 * fuse_inval_files_work() wakes fi->page_waitq, which is initialised
+	 * for regular files only - for other inode types it is not a
+	 * waitqueue at all.
+	 */
+	if (!S_ISREG(inode->i_mode)) {
+		iput(inode);
+		return -EOPNOTSUPP;
+	}
+
 	fi = get_fuse_inode(inode);
 
 	/*

---
base-commit: ca54f152160587a74ff17cb52feef16f7b9d4e2b
change-id: 20260928-b4-prep-kh-vstor-147641-fuse_notify_inval_files-213ca0da419a

Best regards,
--  
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

^ permalink raw reply	[flat|nested] 2+ messages in thread