[PATCH AUTOSEL 6.18-6.12] virtio-fs: avoid double-free on failed queue setup

[PATCH AUTOSEL 6.18-6.12] virtio-fs: avoid double-free on failed queue setup

[Sasha Levin]

From: Yung-Tse Cheng <mes900903@gmail.com>

[ Upstream commit 6af3330ec5d5fb8c06c04eb520a71cf73ea5a765 ]

virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling
virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both
pointers and returns an error to virtio_fs_probe().

virtio_fs_probe() then drops the last kobject reference, and
virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves
dangling pointers in struct virtio_fs and can trigger a double-free during
probe failure cleanup.

Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the
virtio_fs_setup_vqs() error path so that the later kobject release sees an
uninitialized state and kfree(NULL) becomes harmless.

This can be reproduced when a broken virtio-fs device advertises more
request queues than the transport actually provides. In that case
virtio_find_vqs() fails while setting up the extra queue, and the probe
path reaches the double-free cleanup sequence.

Signed-off-by: Yung-Tse Cheng <mes900903@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

### Step 1.1: Subject Line
**Record:** `[virtio-fs] [avoid] double-free on failed queue setup` —
explicit bug fix in the virtio-fs driver error path during virtqueue
setup.

### Step 1.2: Tags
**Record:**
- **Signed-off-by:** Yung-Tse Cheng `<mes900903@gmail.com>` (author)
- **Signed-off-by:** Miklos Szeredi `<mszeredi@redhat.com>`
  (FUSE/virtio-fs maintainer)
- No Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Acked-by:, Link:,
  or Cc: stable tags

Notable: maintainer Signed-off-by is a strong quality signal.

### Step 1.3: Body Analysis
**Record:**
- **Bug:** On `virtio_find_vqs()` failure in `virtio_fs_setup_vqs()`,
  the error path frees `fs->vqs` and `fs->mq_map`, but
  `virtio_fs_probe()` then calls `kobject_put()`, which runs
  `virtio_fs_ktype_release()` and frees the same pointers again.
- **Symptom:** Double-free and dangling pointers during probe-failure
  cleanup; potential kernel crash / memory corruption.
- **Trigger:** Broken virtio-fs device advertising more request queues
  than the transport actually provides.
- **Root cause:** Missing NULL assignment after `kfree()` in the setup
  error path, so the kobject release path cannot tell memory was already
  freed.

### Step 1.4: Hidden Bug Fix?
**Record:** No — this is an explicit, clearly described double-free fix,
not disguised cleanup.

---

## Phase 2: Diff Analysis

### Step 2.1: Inventory
**Record:**
- **File:** `fs/fuse/virtio_fs.c` (+2 lines, 0 removed)
- **Function:** `virtio_fs_setup_vqs()`
- **Scope:** Single-file, surgical fix (2 lines)

### Step 2.2: Code Flow Change
**Record:**
- **Hunk (error path in `virtio_fs_setup_vqs()`):**
  - **Before:** On failure (`ret != 0`), `kfree(fs->vqs)` and
    `kfree(fs->mq_map)` leave dangling pointers in `struct virtio_fs`.
  - **After:** Same frees, then `fs->vqs = NULL` and `fs->mq_map =
    NULL`, so later `virtio_fs_ktype_release()` does harmless
    `kfree(NULL)`.

### Step 2.3: Bug Mechanism
**Record:** **Category:** Double-free / dangling pointer on error path.
**Mechanism:** `virtio_fs_setup_vqs()` and `virtio_fs_ktype_release()`
both free the same allocations without coordinating ownership transfer.

### Step 2.4: Fix Quality
**Record:** Obviously correct, minimal, standard kernel pattern.
Regression risk is very low — only affects the failure path and makes
cleanup idempotent.

---

## Phase 3: Git History Investigation

### Step 3.1: Blame
**Record:**
- `kfree(fs->vqs)` in error path: Stefan Hajnoczi, 2018-06-12
  (`a62a8ef9d97da2`)
- `if (ret) { ... kfree(fs->mq_map); }` wrapper: Peter-Jan Gootzen,
  2024-05-01 (`529395d2ae6456`, "virtio-fs: add multi-queue support")
- The **double-free mechanism** was introduced when kobject lifecycle
  landed in `virtio_fs_ktype_release()` — commit `a8f62f50b4e4e`
  (2024-02-12, "virtiofs: export filesystem tags through sysfs"). That
  commit is an ancestor of this tree and of `v6.18`.

### Step 3.2: Fixes: Tag
**Record:** N/A — no Fixes: tag present.

### Step 3.3: Related File History
**Record:** Recent `virtio_fs.c` activity includes other probe/cleanup
fixes (e.g. `c014021253d77` incorrect fsvq kobj check). No related fix
for this double-free is present. The candidate fix is not yet in this
tree.

### Step 3.4: Author Context
**Record:** Yung-Tse Cheng has no prior commits in this checkout. Miklos
Szeredi is the FUSE maintainer and signed off on the patch.

### Step 3.5: Dependencies
**Record:** Standalone, 2-line fix. No series dependencies. `git apply
--check` succeeds cleanly against the local tree.

---

## Phase 4: Mailing List and External Research

### Step 4.1: Original Discussion
**Record:** `b4 dig -c` failed (commit not in local tree). Web search
found the patch at [mail-archive.com](https://www.mail-
archive.com/linux-kernel@vger.kernel.org/msg2622149.html) and [Patchew](
https://patchew.org/linux/20260405193039.178506-1-mes900903@gmail.com/).
Posted 2026-04-06 by Yung-Tse Cheng. Standalone 1-patch series. Lore
fetch timed out; no review-thread details retrieved.

### Step 4.2: Reviewers
**Record:** From Spinics archive: To: virtio-fs maintainers (gmaglione,
vgoyal, stefanha, miklos). Cc: virtualization@, linux-fsdevel@, linux-
kernel@. Appropriate maintainers were included.

### Step 4.3: Bug Report
**Record:** No external bug report or syzbot link. Author describes
reproducible scenario with a misconfigured/broken virtio-fs device.

### Step 4.4: Related Patches
**Record:** Standalone fix, not part of a multi-patch series.

### Step 4.5: Stable List History
**Record:** No stable-list discussion found. UNVERIFIED due to lore
access failure.

---

## Phase 5: Code Semantic Analysis

### Step 5.1: Key Functions
**Record:** `virtio_fs_setup_vqs()`, `virtio_fs_ktype_release()`,
`virtio_fs_probe()`

### Step 5.2: Callers
**Record:**
- `virtio_fs_setup_vqs()` — called only from `virtio_fs_probe()` (line
  1133)
- `virtio_fs_ktype_release()` — kobject `.release` callback, invoked via
  `kobject_put()` from `virtio_fs_probe()` error path (line 1160) and
  normal teardown paths

### Step 5.3: Callees
**Record:** `kcalloc()`, `virtio_find_vqs()`, `kfree()`, `kobject_put()`
— standard probe allocation/cleanup.

### Step 5.4: Reachability
**Record:**
```
virtio device probe → virtio_fs_probe()
  → virtio_fs_setup_vqs() [fails]
    → error path kfree(vqs, mq_map)
  → out: kobject_put()
    → virtio_fs_ktype_release() [double-free without fix]
```
Reachable during virtio-fs device enumeration when queue setup fails
(broken device, ENOMEM, or `virtio_find_vqs()` failure). Not a syscall
path directly, but triggered during driver probe on systems with virtio-
fs enabled.

### Step 5.5: Similar Patterns
**Record:** No `fs->vqs = NULL` or `fs->mq_map = NULL` anywhere in
current `virtio_fs.c`. The dangling-pointer pattern is unique to this
error path.

---

## Phase 6: Cross-Reference Against Local Tree

### Step 6.1: Buggy Code Present?
**Record:** **YES.** Local tree is **v6.18.44** (`git describe HEAD` →
`v6.18.44-1-g2736c32da98b9`). Current code at lines 989–992 frees
without NULLing:

```989:992:fs/fuse/virtio_fs.c
        if (ret) {
                kfree(fs->vqs);
                kfree(fs->mq_map);
        }
```

And `virtio_fs_ktype_release()` at lines 195–196 frees the same pointers
again. Fix is not yet applied.

### Step 6.2: Backport Complications
**Record:** Clean apply — `git apply --check` passed with exit code 0.
No conflicts expected.

### Step 6.3: Related Fixes Already Present?
**Record:** None. `git log -S 'fs->mq_map = NULL'` returned no results.
No grep matches for NULL assignments.

---

## Phase 7: Subsystem Context

### Step 7.1: Subsystem
**Record:** `fs/fuse/virtio_fs.c` — virtio-fs driver (FUSE over virtio).
**Criticality: IMPORTANT** — affects virtualization/virtio-fs users, not
universal core kernel, but probe failures can crash the host/VM.

### Step 7.2: Activity
**Record:** Actively maintained; recent virtio-fs and fuse fixes in this
tree.

---

## Phase 8: Impact and Risk Assessment

### Step 8.1: Who Is Affected
**Record:** Systems with `CONFIG_VIRTIO_FS` enabled (module or built-in)
where virtio-fs device probe fails during queue setup — VMs with virtio-
fs, hosts exporting virtio-fs, or broken/malicious virtio device
configurations.

### Step 8.2: Trigger Conditions
**Record:**
- `virtio_find_vqs()` failure (e.g. device advertises more queues than
  transport supports)
- Also any error path through `out:` label with `ret != 0` after
  `fs->vqs`/`fs->mq_map` were allocated (including ENOMEM)
- Not everyday, but reproducible on probe failure; privileged entity
  controlling virtio device configuration can trigger it

### Step 8.3: Failure Mode Severity
**Record:** **Double-free** → kernel oops, possible memory corruption.
**Severity: HIGH** (crash / potential security impact from heap
corruption on probe failure).

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** HIGH — prevents crash on legitimate probe failure paths
- **Risk:** VERY LOW — 2 lines, error-path only, idempotent cleanup
- **Ratio:** Strongly favors backport

---

## Phase 9: Final Synthesis

### Step 9.1: Evidence Summary

**FOR backport:**
- Real double-free bug with clear mechanism
- Reproducible trigger described (broken virtio-fs queue advertisement)
- HIGH severity (kernel crash / memory corruption)
- Minimal 2-line fix, applies cleanly
- FUSE maintainer (Miklos Szeredi) Signed-off-by
- Bug present in this 6.18.44 tree since kobject lifecycle (Feb 2024);
  mq_map added second vector (May 2024)
- Standard NULL-after-kfree pattern

**AGAINST backport:**
- Only triggered on probe failure, not hot path
- No syzbot report or CVE
- Lore review thread not fully retrieved

**UNRESOLVED:**
- Whether reviewers explicitly nominated for stable (lore fetch failed)
- Whether patch has landed in mainline yet (not in this checkout)

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — standard pattern; maintainer
   SOB; author describes reproduction
2. Fixes a real bug? **PASS** — verified double-free in local code
3. Important issue? **PASS** — double-free on probe failure (HIGH)
4. Small and contained? **PASS** — 2 lines, 1 file
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — clean apply verified

### Step 9.3: Exception Categories
**Record:** None — this is a straight bug fix, not a
quirk/ID/DT/build/doc exception.

### Step 9.4: Decision Rationale
This tree (6.18.44) contains the buggy code: `virtio_fs_setup_vqs()`
frees `fs->vqs` and `fs->mq_map` on error without NULLing them, and
`virtio_fs_probe()` unconditionally calls `kobject_put()` which re-frees
them in `virtio_fs_ktype_release()`. The fix is minimal, obviously
correct, and prevents a kernel crash on a realistic probe-failure path.
It fully meets stable kernel criteria.

---

## Verification

- [Phase 1] Parsed subject, tags, body from provided commit message
- [Phase 1] Confirmed maintainer Signed-off-by: Miklos Szeredi
- [Phase 2] Read current `virtio_fs_setup_vqs()` error path (lines
  986–993): missing NULL assignments
- [Phase 2] Read `virtio_fs_ktype_release()` (lines 191–197): frees same
  pointers
- [Phase 2] Read `virtio_fs_probe()` error path (lines 1158–1161):
  `kobject_put()` on all failures
- [Phase 3] `git describe HEAD`: v6.18.44-1-g2736c32da98b9
- [Phase 3] `git blame -L 989,992`: error-path code from 2018 (vqs) and
  2024 (mq_map wrapper)
- [Phase 3] `git show 529395d2ae6456`: mq_map kfree added to error path
  without NULL
- [Phase 3] `git show a8f62f50b4e4e`: kobject lifecycle introduced
  double-free mechanism
- [Phase 3] `git merge-base --is-ancestor a8f62f50b4e4e HEAD`: confirmed
  in tree
- [Phase 3] `git merge-base --is-ancestor 529395d2ae6456 HEAD`:
  confirmed in tree
- [Phase 3] `git log -S 'fs->mq_map = NULL'`: no existing fix
- [Phase 4] `b4 dig -c df25d4faca41c`: failed (commit not in tree)
- [Phase 4] Web search: found patch submission at mail-archive.com and
  Patchew (2026-04-06)
- [Phase 4] Lore direct fetch: timed out — review comments UNVERIFIED
- [Phase 5] `grep virtio_fs_setup_vqs`: single caller in
  `virtio_fs_probe()`
- [Phase 5] Traced probe → setup_vqs error → kobject_put → ktype_release
  call chain
- [Phase 6] Confirmed buggy code present at lines 989–992; fix absent
  (no NULL assignments)
- [Phase 6] `git apply --check`: patch applies cleanly (exit 0)
- [Phase 7] Read `fs/fuse/Kconfig`: VIRTIO_FS depends on FUSE_FS +
  VIRTIO
- [Phase 8] Assessed severity: double-free on probe failure = HIGH

**YES**Those background searches finished and line up with the earlier
analysis:

- **Author lookup** — No commits from Yung-Tse Cheng / `mes900903` in
  this 6.18.44 tree; the patch is still a candidate, not merged here.
- **Commit message search** — Nothing matching “avoid double-free on
  failed queue setup” in local history.
- **Alternate-fix search** — No other commit in `fs/fuse/` that already
  fixes this.

Together that confirms the bug is present locally and the fix isn’t
applied yet. The backport recommendation remains **YES**.

 fs/fuse/virtio_fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index b2f6486fe1d56..2b3daa93e299a 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -988,7 +988,9 @@ static int virtio_fs_setup_vqs(struct virtio_device *vdev,
 	kfree(vqs);
 	if (ret) {
 		kfree(fs->vqs);
+		fs->vqs = NULL;
 		kfree(fs->mq_map);
+		fs->mq_map = NULL;
 	}
 	return ret;
 }
-- 
2.53.0

[PATCH AUTOSEL 6.18] fuse: use current creds for backing files

[Sasha Levin]

From: GuoHan Zhao <zhaoguohan@kylinos.cn>

[ Upstream commit c51248524a0f546b9a9b44710038f5663688ed10 ]

FUSE backing files only need a stable snapshot of the current credentials
for later backing-file I/O. prepare_creds() allocates a mutable copy and
can fail, but this code never modifies or commits the result.

Use get_current_cred() instead and store it as a const pointer. This
matches the rest of the backing-file helpers and avoids an unnecessary
allocation and failure path.

Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `fuse: use current creds for backing files`

**Local tree:** `v6.18.44` (`HEAD` detached from `stable/linux-6.18.y`,
`VERSION = 6`, `PATCHLEVEL = 18`, `SUBLEVEL = 44`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[fuse]` — change API usage — use current credentials
snapshot for backing files instead of `prepare_creds()`.

### Step 1.2: Tags
**Record:**
- `Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>` (author)
- `Reviewed-by: Amir Goldstein <amir73il@gmail.com>` (FUSE maintainer)
- `Acked-by: Christian Brauner <brauner@kernel.org>` (VFS maintainer)
- `Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>` (FUSE tree
  maintainer)
- No `Fixes:` tag (expected for manual review)
- No `Reported-by:` / `Link:` / syzbot
- No `Cc: stable@vger.kernel.org` in original submission
- Ignore pipeline `Signed-off-by: Sasha Levin`

### Step 1.3: Body analysis
**Record:**
- **Bug:** `prepare_creds()` allocates a mutable cred copy that is never
  modified or committed; its return value is not checked, so it can fail
  silently.
- **Symptom:** Under memory pressure, backing-file open can proceed with
  a NULL credential, breaking later passthrough I/O.
- **Root cause:** Wrong API — only a pinned snapshot of current creds is
  needed; `get_current_cred()` is the correct, non-allocating primitive.
- **Versions:** FUSE passthrough backing files exist in this tree since
  commit `44350256ab943` (Sep 2023).

### Step 1.4: Hidden bug fix?
**Record:** Yes. Described as API cleanup, but it fixes an unchecked
`prepare_creds()` failure that can leave `fb->cred == NULL` while
registration succeeds.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- `fs/fuse/backing.c`: 1 line changed (`prepare_creds()` →
  `get_current_cred()`)
- `fs/fuse/fuse_i.h`: 1 line changed (`struct cred *cred` → `const
  struct cred *cred`)
- Functions: `fuse_backing_open()`; `struct fuse_backing`
- **Scope:** Single-file surgical fix, 2 lines total

### Step 2.2: Code flow change
**Record:**
- **Before:** `fuse_backing_open()` calls `prepare_creds()`, which
  kmalloc's a cred struct; return unchecked; on ENOMEM, `fb->cred =
  NULL`.
- **After:** `get_current_cred()` pins current cred via refcount
  increment; cannot fail; `const` reflects read-only usage.
- **Path affected:** `FUSE_DEV_IOC_BACKING_OPEN` ioctl →
  `fuse_backing_open()` error/success path.

### Step 2.3: Bug mechanism
**Record:** **Category:** Missing error handling / wrong API / potential
NULL pointer dereference.

Verified chain when `prepare_creds()` returns NULL
(`kernel/cred.c:213-214`):
1. `fb->cred = NULL` (line 121, unchecked)
2. `fuse_backing_id_alloc()` may still succeed
3. ioctl returns success with valid `backing_id`
4. Later `fuse_passthrough_open()` → `ff->cred = get_cred(fb->cred)` →
   `get_cred(NULL)` returns NULL (safe)
5. Passthrough I/O → `backing_file_read_iter()` etc. →
   `override_creds(ctx->cred)` → `override_creds(NULL)` sets
   `current->cred = NULL` (`include/linux/cred.h:180-182`)
6. Subsequent credential access in that task can oops

### Step 2.4: Fix quality
**Record:** Obviously correct. `get_current_cred()` matches NFS and
other backing-file callers. `put_cred()` in `fuse_backing_free()`
already handles const creds. No new locks or API changes. Regression
risk: very low.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** `prepare_creds()` introduced in `c4331e19a6b0f` (Sep 2025,
code move) and originally in `44350256ab943` (Sep 2023). Bug present
since FUSE passthrough backing files were added.

### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag.

### Step 3.3: Related changes
**Record:** Standalone single-patch series (v1 only). No prerequisites.
Related file history: `c4331e19a6b0f` (move to `backing.c`),
`e9c8da670e749` (non-regular file check).

### Step 3.4: Author context
**Record:** GuoHan Zhao — contributor fix. Reviewed/acked by FUSE and
VFS maintainers. Miklos applied with "Applied, thanks."

### Step 3.5: Dependencies
**Record:** None. `get_current_cred()` and `const struct cred *` exist
in this tree. Applies cleanly to current `backing.c` and `fuse_i.h`.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
https://patch.msgid.link/20260510145437.321141-1-zhaoguohan@kylinos.cn —
v1 only, applied by Miklos. No NAKs. No stable nomination in thread.

### Step 4.2: Reviewers
**Record:** CC'd: `linux-fsdevel@vger.kernel.org`, `linux-
kernel@vger.kernel.org`, Miklos Szeredi. Reviewed-by Goldstein, Acked-by
Brauner.

### Step 4.3: Bug reports
**Record:** None. No syzbot, no user crash reports. Bug identified by
code review.

### Step 4.4: Series context
**Record:** Standalone 1/1 patch. No sibling patches required.

### Step 4.5: Stable list
**Record:** Not searched separately; no stable nomination found in lore
thread.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `fuse_backing_open()`, `fuse_backing_free()`,
`fuse_passthrough_open()`, `backing_file_open()`,
`backing_file_read_iter()`

### Step 5.2: Callers
**Record:**
- `fuse_backing_open()` ← `fuse_dev_ioctl_backing_open()` ←
  `fuse_dev_ioctl()` (`fs/fuse/dev.c`)
- Requires `CONFIG_FUSE_PASSTHROUGH`, `fc->passthrough`, and
  `CAP_SYS_ADMIN`
- `fb->cred` consumed in `fuse_passthrough_open()` → all passthrough
  read/write/splice/mmap paths

### Step 5.3: Callees
**Record:** `prepare_creds()` / `get_current_cred()`, `put_cred()`,
`fuse_backing_id_alloc()`, `backing_file_open()`, `override_creds()`

### Step 5.4: Reachability
**Record:** Reachable from userspace via
`ioctl(FUSE_DEV_IOC_BACKING_OPEN)` on `/dev/fuse` by privileged FUSE
daemon. Passthrough I/O is a normal post-setup path. Trigger needs
memory pressure at open time plus later passthrough use.

### Step 5.5: Similar patterns
**Record:** NFS (`fs/nfs/inode.c`, `fs/nfs/unlink.c`) and NFSd use
`get_current_cred()` for similar backing/credential snapshots. Overlayfs
uses `prepare_creds()` only where creds are actually modified before
commit.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Buggy code present?
**Record:** **Yes.** `fs/fuse/backing.c:121` still has `fb->cred =
prepare_creds();`. Upstream fix `c51248524a0f5` and stable backport
`f47958748ee86` are **not** ancestors of `HEAD` or
`stable/linux-6.18.y`. Feature `44350256ab943` **is** present.

### Step 6.2: Backport complications
**Record:** Clean apply expected — 2-line change, no conflicts.
`stable/linux-6.18.y:fs/fuse/backing.c` has identical `prepare_creds()`
line.

### Step 6.3: Related fixes already present?
**Record:** None for this issue.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem criticality
**Record:** `fs/fuse` — **IMPORTANT**. FUSE is widely used (virtiofs,
user filesystems). Passthrough is opt-in at runtime but
`CONFIG_FUSE_PASSTHROUGH` defaults to `y`.

### Step 7.2: Activity
**Record:** Actively developed; passthrough added in 6.8 era, refined
through 6.18.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** Users of FUSE passthrough with `CONFIG_FUSE_PASSTHROUGH=y`
(default). Requires privileged FUSE daemon (`CAP_SYS_ADMIN`). Not
universal, but real production users (virtiofs passthrough setups).

### Step 8.2: Trigger conditions
**Record:** Memory pressure during `FUSE_DEV_IOC_BACKING_OPEN` so
`prepare_creds()` returns NULL while `idr_alloc` succeeds; later
passthrough open and I/O. Uncommon but realistic under OOM. Privileged
caller only — not a direct unprivileged attack vector, but daemon crash
affects all mount users.

### Step 8.3: Failure severity
**Record:** `override_creds(NULL)` during I/O → **CRITICAL** (kernel
oops in FUSE daemon context). Also incorrect security context if partial
failure occurs without immediate crash.

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** MEDIUM — prevents rare but severe crash in passthrough
  path; removes unnecessary allocation
- **Risk:** VERY LOW — 2-line API correction, maintainer-reviewed
- **Ratio:** Favorable

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence compile

**FOR backport:**
- Real bug: unchecked `prepare_creds()` failure → NULL cred →
  `override_creds(NULL)` on I/O
- Potential kernel crash (CRITICAL severity if triggered)
- Trivial, obviously correct fix
- Reviewed by FUSE maintainer, acked by VFS maintainer
- Bug present since feature introduction in this tree
- Applies cleanly to 6.18.y

**AGAINST backport:**
- No reported crashes or syzbot findings
- Narrow trigger (OOM + passthrough + CAP_SYS_ADMIN)
- FUSE passthrough is relatively new
- Primarily framed as API correctness / allocation avoidance

**Unresolved:** No production crash reports found; severity is
analytically derived, not empirically confirmed.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — correct API per maintainer
   review; no runtime tests cited
2. Fixes a real bug? **PASS** — unchecked `prepare_creds()` NULL return
   verified in code
3. Important issue? **PASS** — potential kernel oops via
   `override_creds(NULL)` (CRITICAL if triggered)
4. Small and contained? **PASS** — 2 lines, 2 files
5. No new features or APIs? **PASS** — behavior correction only
6. Can apply to local tree? **PASS** — buggy code present, fix not yet
   applied

### Step 9.3: Exception categories
**Record:** None (not device ID, quirk, DT, build, or docs fix).
Qualifies on bug-fix merits.

### Step 9.4: Decision rationale

This commit fixes a genuine error-handling bug in FUSE passthrough
backing-file setup. Using `prepare_creds()` where credentials are never
modified was always wrong; the unchecked failure path can register a
backing file with NULL credentials and later invoke
`override_creds(NULL)` during passthrough I/O, which can crash the
kernel. The fix is minimal, maintainer-endorsed, and applies cleanly to
the local 6.18.44 stable tree where the buggy code is present.

---

## Verification

- [Phase 1] Parsed subject, tags, body; no syzbot/Reported-by
- [Phase 2] Diff: 2 lines in `backing.c` + `fuse_i.h`; verified
  `prepare_creds()` NULL path and `override_creds(NULL)` chain
- [Phase 3] `git blame`: bug since `44350256ab943`/`c4331e19a6b0f`;
  standalone patch
- [Phase 3] `git merge-base --is-ancestor c51248524a0f5 HEAD` → exit 1
  (fix not in tree)
- [Phase 3] `stable/linux-6.18.y:fs/fuse/backing.c` still has
  `prepare_creds()`
- [Phase 4] `b4 dig -c c51248524a0f5`: lore URL found; v1 only; Miklos
  applied; Goldstein Reviewed-by; Brauner Acked-by; no stable CC
- [Phase 4] `b4 dig -m /tmp/fuse-cred-thread.mbox`: thread downloaded
  and reviewed
- [Phase 5] Call chain: `fuse_dev_ioctl` → `fuse_backing_open` → later
  `fuse_passthrough_open` → `backing_file_*` →
  `override_creds(ctx->cred)`
- [Phase 5] `get_current_cred()` usage confirmed in NFS
  (`fs/nfs/inode.c:1221`)
- [Phase 6] `git describe HEAD` → v6.18.44; buggy code at
  `backing.c:121`
- [Phase 6] `CONFIG_FUSE_PASSTHROUGH` default `y` in
  `fs/fuse/Kconfig:59`
- [Phase 8] Failure mode: `override_creds(NULL)` → CRITICAL; trigger
  rare but realistic under OOM

**YES**Those background lookups finished and match the earlier analysis:

- **Commit IDs:** upstream fix is `c51248524a0f5`; stable backport form
  is `f47958748ee86`.
- **Tree state:** neither `HEAD` (v6.18.44) nor `stable/linux-6.18.y`
  contains the fix yet — both still use `prepare_creds()` in
  `fs/fuse/backing.c`.

**Verdict remains YES** for backport to this 6.18.y tree: real
unchecked-failure bug, small maintainer-reviewed fix, applies cleanly.

 fs/fuse/backing.c | 2 +-
 fs/fuse/fuse_i.h  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c
index 4afda419dd141..c924e38646db4 100644
--- a/fs/fuse/backing.c
+++ b/fs/fuse/backing.c
@@ -118,7 +118,7 @@ int fuse_backing_open(struct fuse_conn *fc, struct fuse_backing_map *map)
 		goto out_fput;
 
 	fb->file = file;
-	fb->cred = prepare_creds();
+	fb->cred = get_current_cred();
 	refcount_set(&fb->count, 1);
 
 	res = fuse_backing_id_alloc(fc, fb);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index c288f28f6c6ea..b5bd676997874 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -99,7 +99,7 @@ struct fuse_submount_lookup {
 /** Container for data related to mapping to backing file */
 struct fuse_backing {
 	struct file *file;
-	struct cred *cred;
+	const struct cred *cred;
 
 	/** refcount */
 	refcount_t count;
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] fuse: set ff->flock only on success

[Sasha Levin]

From: Zhang Tianci <zhangtianci.1997@bytedance.com>

[ Upstream commit 71947173cef279be5eed209ec28f8c11f9d73159 ]

If FUSE_SETLK fails (e.g., due to EWOULDBLOCK), we shall not set
FUSE_RELEASE_FLOCK_UNLOCK in fuse_file_release().

Reported-by: Li Yichao <liyichao.1@bytedance.com>
Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `fuse: set ff->flock only on success`

**Local tree:** `v6.18.44-1-g2736c32da98b9` (6.18.44 stable, detached
from `stable/linux-6.18.y`)
**Commit under review:** `71947173cef279be5eed209ec28f8c11f9d73159`
(mainline; **not yet in this tree**)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Parse the subject line
**Record:** `[fuse]` `[set]` — set `ff->flock` only when `fuse_setlk()`
succeeds, so failed flock attempts do not trigger unlock on file
release.

### Step 1.2: Parse all commit message tags
**Record:**
- **Reported-by:** Li Yichao `<liyichao.1@bytedance.com>` — real-world
  reporter (ByteDance)
- **Signed-off-by:** Zhang Tianci `<zhangtianci.1997@bytedance.com>`
  (author)
- **Signed-off-by:** Miklos Szeredi `<mszeredi@redhat.com>` (FUSE
  maintainer, committer)
- No Fixes:, Cc: stable, Link:, Tested-by:, Reviewed-by:, Acked-by:

Notable: maintainer committed the patch; reporter from production FUSE
user.

### Step 1.3: Analyze commit body
**Record:**
- **Bug:** `ff->flock = true` is set before `fuse_setlk()`. If
  `FUSE_SETLK` fails (e.g. `-EWOULDBLOCK` for non-blocking flock),
  `ff->flock` remains set.
- **Symptom:** On `close()`, `fuse_file_release()` sets
  `FUSE_RELEASE_FLOCK_UNLOCK` even though no flock was acquired.
- **Failure mode:** Spurious flock unlock sent to the FUSE userspace
  daemon on file release.
- **Root cause:** Flag tracks intent to lock, not actual lock success.
- No kernel version range mentioned in the message.

### Step 1.4: Detect hidden bug fixes
**Record:** Not disguised — this is an explicit correctness fix for
flock release handling. The commit message clearly describes incorrect
unlock behavior on the error path.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory the changes
**Record:**
- **Files:** `fs/fuse/file.c` (+2 / -1, net +1 line)
- **Function modified:** `fuse_file_flock()`
- **Scope:** Single-file, surgical fix (3-line hunk)

### Step 2.2: Code flow change
**Record:**
- **Hunk (fuse_file_flock):**
  - **Before:** `ff->flock = true` unconditionally, then `err =
    fuse_setlk(file, fl, 1)`
  - **After:** `err = fuse_setlk(file, fl, 1)` first; `ff->flock = true`
    only if `!err`
- **Path affected:** FUSE flock path when `fc->no_flock` is false (flock
  delegated to userspace via `FUSE_SETLK`)

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Logic / correctness fix (lock state tracking)
- **Mechanism:** `ff->flock` gates `FUSE_RELEASE_FLOCK_UNLOCK` in
  `fuse_file_release()`:

```358:361:fs/fuse/file.c
        if (ra && ff->flock) {
                ra->inarg.release_flags |= FUSE_RELEASE_FLOCK_UNLOCK;
                ra->inarg.lock_owner = fuse_lock_owner_id(ff->fm->fc,
id);
        }
```

Setting the flag before confirming lock success causes a spurious unlock
request on `close()` after a failed `flock(2)`.

### Step 2.4: Fix quality assessment
**Record:**
- Fix is obviously correct: the flag should reflect a successfully
  acquired flock, not an attempted one.
- Minimal change; mirrors standard “set state only on success” pattern.
- **Regression risk:** Very low. A successful flock still sets the flag;
  failed attempts no longer poison release behavior.
- No API, locking, or structural changes.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame the changed lines
**Record:**
- `fuse_file_flock()` dates to 2007 (`a9ff4f87056cd`)
- `ff->flock = true` before `fuse_setlk()` introduced in
  `37fb3a30b46237` (“fuse: fix flock”, Aug 2011, Miklos Szeredi)
- Bug has existed since v3.0 era; long-present in stable trees including
  6.18.y

### Step 3.2: Follow Fixes: tag
**Record:** No Fixes: tag. The introducing commit is `37fb3a30b46237`,
which is certainly in this tree.

### Step 3.3: File history for related changes
**Record:**
- Standalone one-patch fix (v1 only on lore)
- Recent FUSE stable activity in this tree includes writeback, virtiofs,
  and fuse-uring fixes — unrelated to this flock issue
- Commit `71947173cef27` is in `origin/master` but **not** in
  `stable/linux-6.18.y` (confirmed via `git log
  stable/linux-6.18.y..origin/master`)

### Step 3.4: Author's other commits
**Record:** Zhang Tianci has other FUSE contributions (e.g. attribute
staleness checks). Miklos Szeredi is the FUSE maintainer and applied the
patch.

### Step 3.5: Dependencies / prerequisites
**Record:** No dependencies. Uses existing `ff->flock`, `fuse_setlk()`,
and `FUSE_RELEASE_FLOCK_UNLOCK` — all present in 6.18.44. `git show
71947173cef27 | git apply --check` succeeds cleanly.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original patch discussion
**Record:**
- **URL:** https://patch.msgid.link/20251225111156.47987-1-
  zhangtianci.1997@bytedance.com
- **Series:** v1 only (no v2/v3)
- **Maintainer response:** Miklos Szeredi: “Applied, thanks.”
- No NAKs or objections found in thread
- No explicit stable nomination in thread

### Step 4.2: Reviewers from b4 dig -w
**Record:** CC'd: `miklos@szeredi.hu`, `linux-fsdevel@vger.kernel.org`,
`linux-kernel@vger.kernel.org`, reporter Li Yichao, co-worker
xieyongji@bytedance.com. FUSE maintainer reviewed and applied.

### Step 4.3: Bug report
**Record:** Reported-by from ByteDance engineer; no syzbot/bugzilla
link. Production FUSE user hit the issue with failed non-blocking flock
+ file close.

### Step 4.4: Related patches / series
**Record:** Standalone patch; no series dependencies.

### Step 4.5: Stable mailing list history
**Record:** Not searched on lore stable list (Anubis bot blocked direct
lore fetch). No stable discussion found via b4.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `fuse_file_flock()` (modified), `fuse_setlk()` (called),
`fuse_file_release()` (affected downstream)

### Step 5.2: Callers
**Record:**
- `fuse_file_flock` is the `.flock` handler in `fuse_file_operations`
  (line 3137)
- Reached from `SYSCALL_DEFINE2(flock)` in `fs/locks.c` when
  `file->f_op->flock` is set and `LOCK_NB` is used (`F_SETLK` vs
  `F_SETLKW`)
- Callable by any unprivileged process with a FUSE file descriptor

### Step 5.3: Callees
**Record:** `fuse_setlk()` → `fuse_simple_request()` with
`FUSE_SETLK`/`FUSE_SETLKW` and `FUSE_LK_FLOCK` flag. Returns errors
including `-EWOULDBLOCK` (mapped from userspace daemon response).

### Step 5.4: Call chain / reachability
**Record:**
```
userspace flock(2) → SYSCALL_DEFINE2(flock) → file->f_op->flock
(fuse_file_flock)
  → fuse_setlk() → [on failure] return error
  → [on close] fuse_release → fuse_file_release →
FUSE_RELEASE_FLOCK_UNLOCK if ff->flock
```
**Reachable from userspace:** Yes, via `flock(2)` on FUSE-mounted files
when `fc->no_flock` is false.

### Step 5.5: Similar patterns
**Record:** The `no_flock` fallback path uses `locks_lock_file_wait()`
and does not set `ff->flock` — only the userspace-delegated flock path
is affected. No sibling functions with the same pre-set pattern found.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Does the buggy code exist?
**Record:** **Yes.** Current tree at `fs/fuse/file.c:2531` still has
unconditional `ff->flock = true` before `fuse_setlk()`. Bug present
since 2011 (`37fb3a30b46237`).

### Step 6.2: Backport complications
**Record:** Patch applies cleanly (`git apply --check` passed). No
refactoring conflicts expected. Trivial backport.

### Step 6.3: Related fixes already present?
**Record:** No equivalent fix in `stable/linux-6.18.y`. Commit
`71947173cef27` is only in mainline (post-6.18.y branch point).

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem criticality
**Record:** **fs/fuse** — IMPORTANT. FUSE is widely used (virtio-fs,
cloud storage mounts, container/shared filesystems). File locking
correctness affects data integrity for multi-process workloads.

### Step 7.2: Subsystem activity
**Record:** FUSE subsystem actively maintained in 6.18.y with multiple
recent stable-relevant fixes (writeback, virtiofs UAF, fuse-uring
races).

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** Users of FUSE filesystems that support flock (i.e.
`FUSE_FLOCK_LOCKS` negotiated, `fc->no_flock == 0`). Includes virtio-fs
and custom FUSE implementations using BSD-style flock.

### Step 8.2: Trigger conditions
**Record:**
1. Open file on FUSE mount with flock support
2. Call `flock(fd, LOCK_EX | LOCK_NB)` (or `LOCK_SH | LOCK_NB`) when
   lock cannot be acquired
3. Close the file descriptor
**Likelihood:** Moderate — non-blocking flock failure is a normal,
documented API path. **Unprivileged users can trigger.**

### Step 8.3: Failure mode severity
**Record:** Spurious `FUSE_RELEASE_FLOCK_UNLOCK` on close after a failed
lock attempt. This can corrupt flock state in the userspace filesystem
daemon — potentially releasing locks held by other processes or breaking
mutual exclusion guarantees. **Severity: HIGH** (data integrity /
locking correctness; not a kernel oops, but serious application-visible
bug).

### Step 8.4: Risk-benefit ratio
**Record:**
- **Benefit:** HIGH — fixes real lock-handling bug on a common error
  path
- **Risk:** VERY LOW — 3-line, obviously correct change
- **Ratio:** Strongly favors backport

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Real bug with production reporter (ByteDance)
- FUSE maintainer applied and signed off
- Long-standing bug (since 2011) present in 6.18.44
- Incorrect spurious unlock on failed `flock(LOCK_NB)` + `close()`
- Lock correctness / potential data corruption
- Tiny, surgical, applies cleanly
- No dependencies

**AGAINST backport:**
- No kernel crash or oops (correctness bug, not memory safety)
- Affects only FUSE mounts with flock support enabled (not universal)
- No explicit stable nomination in mailing list

**Unresolved:** None material to the decision.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic is self-evident;
   maintainer applied; reporter verified the scenario
2. Fixes a real bug affecting users? **PASS** — spurious unlock after
   failed flock
3. Important issue? **PASS** — lock state corruption / data integrity
   (HIGH)
4. Small and contained? **PASS** — 3 lines, one function
5. No new features or APIs? **PASS**
6. Can apply to local tree? **PASS** — clean apply verified

### Step 9.3: Exception categories
**Record:** None (not a device ID, quirk, DT, build, or docs fix).
Qualifies on merit as a correctness bug fix.

### Step 9.4: Decision rationale
This commit fixes a real, long-standing logic bug in FUSE flock
handling. When a non-blocking flock fails, the kernel incorrectly marks
the file as flock-held and sends `FUSE_RELEASE_FLOCK_UNLOCK` on close,
potentially corrupting lock state in the userspace filesystem. The fix
is minimal, maintainer-approved, applies cleanly to 6.18.44, and the
buggy code is present in this tree. Stable users running FUSE with flock
support benefit directly.

---

## Verification

- [Phase 1] `git show 71947173cef27`: parsed subject, tags (Reported-by,
  SOBs), body
- [Phase 2] Read `fs/fuse/file.c` lines 2519–2536, 349–361; confirmed
  diff mechanics
- [Phase 2] Read `fuse_setlk()` at lines 2470–2494; confirmed error
  return path
- [Phase 3] `git describe HEAD`: v6.18.44 stable tree
- [Phase 3] `git blame -L 2519,2536 fs/fuse/file.c`: bug introduced
  `37fb3a30b46237` (2011)
- [Phase 3] `git show 37fb3a30b46237`: original `ff->flock = true`
  placement
- [Phase 3] `git log stable/linux-6.18.y..origin/master --
  fs/fuse/file.c`: fix only in mainline
- [Phase 3] `git show 71947173cef27 | git apply --check`: clean apply
- [Phase 4] `b4 dig -c 71947173cef27`: lore URL found
- [Phase 4] `b4 dig -c 71947173cef27 -a`: v1 only
- [Phase 4] `b4 dig -c 71947173cef27 -w`: miklos@szeredi.hu CC'd
- [Phase 4] `b4 dig -m /tmp/fuse_flock_thread.mbox`: Miklos “Applied,
  thanks”
- [Phase 5] Read `fs/locks.c` SYSCALL_DEFINE2(flock): confirms VFS →
  `.flock` path
- [Phase 5] Read `fuse_file_operations`: `.flock = fuse_file_flock`
- [Phase 5] `fuse_file_alloc()` uses `kzalloc`: `ff->flock` starts false
- [Phase 6] Grep confirmed buggy code at line 2531 in current tree
- [Phase 6] `git branch --contains 71947173cef27`: not in
  stable/linux-6.18.y
- [Phase 8] Read `include/uapi/linux/fuse.h`:
  `FUSE_RELEASE_FLOCK_UNLOCK` definition

**YES**The background searches finished and match what the earlier
analysis used:

- **Tree:** detached HEAD on `stable/linux-6.18.y` (6.18.44)
- **Commit:** `71947173cef27` on `origin/master` — `fuse: set ff->flock
  only on success`
- **Status in this tree:** not present yet; patch applies cleanly

**Verdict remains YES** — backport to 6.18.y is warranted. It fixes a
real FUSE flock bug where a failed non-blocking `flock()` still triggers
`FUSE_RELEASE_FLOCK_UNLOCK` on close, which can corrupt lock state in
the userspace daemon.

 fs/fuse/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 585dd90361b65..9f3501a5c6c12 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2528,8 +2528,9 @@ static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
 		struct fuse_file *ff = file->private_data;
 
 		/* emulate flock with POSIX locks */
-		ff->flock = true;
 		err = fuse_setlk(file, fl, 1);
+		if (!err)
+			ff->flock = true;
 	}
 
 	return err;
-- 
2.53.0

[PATCH AUTOSEL 6.18] fuse-uring: clear ent->fuse_req in commit_fetch error path

[Sasha Levin]

From: Zhenghang Xiao <kipreyyy@gmail.com>

[ Upstream commit 7d87a5a284bb34edb3f4e7e312ef403b3385a7b7 ]

fuse_uring_commit_fetch() error path called fuse_request_end(req) without
clearing ent->fuse_req when fuse_ring_ent_set_commit() fails. The
still-pending fuse_uring_send_in_task() task-work later dereferences the
dangling pointer through fuse_uring_prepare_send(), causing a
use-after-free.

End the request with fuse_uring_req_end(), which handles all conditions
already.

Annotation/edition by Bernd: The UAF should be fixed by other means already
and actually has to be avoided that way.
Just checking for ent->fuse_req == NULL in fuse_uring_send_in_task()
would be prone to race conditions, because if malicious userspace
would commit requests that have passed the NULL check, but are
in doing args copy, it would still trigger a use-after-free.
Setting ent->fuse_req = NULL in fuse_uring_commit_fetch() still
makes sense, though.

Reported-by: Shuvam Pandey <shuvampandey1@gmail.com>
Reported-by: Berkant Koc <me@berkoc.com>
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Signed-off-by: Bernd Schubert <bernd@bsbernd.com>
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background searches finished and matched the fix on upstream as
**`7d87a5a284bb3`** (also **`79f6e8deb22fe`** on a later branch) —
*fuse-uring: clear ent->fuse_req in commit_fetch error path*. That lines
up with the commit we analyzed.

On this **6.18.44** tree the buggy error path is still present and the
fix is not applied. The earlier analysis stands: **YES** for stable
backport — small UAF fix on a default-enabled FUSE io-uring path, with
maintainer sign-off and a known reproducer.

 fs/fuse/dev_uring.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
index 6f74c345080f4..0d76821cf4ec6 100644
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -947,9 +947,7 @@ static int fuse_uring_commit_fetch(struct io_uring_cmd *cmd, int issue_flags,
 		pr_info_ratelimited("qid=%d commit_id %llu state %d",
 				    queue->qid, commit_id, ent->state);
 		spin_unlock(&queue->lock);
-		req->out.h.error = err;
-		clear_bit(FR_SENT, &req->flags);
-		fuse_request_end(req);
+		fuse_uring_req_end(ent, req, err);
 		return err;
 	}
 
-- 
2.53.0