[PATCH 2/8] fuse: flush pending fuse events before aborting the connection

Darrick J. Wong
2025-09-16T00:24:33Z

generic/488 fails with fuse2fs in the following fashion:

generic/488 _check_generic_filesystem: filesystem on /dev/sdf is inconsistent
(see /var/tmp/fstests/generic/488.full for details)

This test opens a large number of files, unlinks them (which really just
renames them to fuse hidden files), closes the program, unmounts the
filesystem, and runs fsck to check that there aren't any inconsistencies
in the filesystem.

Unfortunately, the 488.full file shows that there are a lot of hidden
files left over in the filesystem, with incorrect link counts. Tracing
fuse_request_* shows that there are a large number of FUSE_RELEASE
commands that are queued up on behalf of the unlinked files at the time
that fuse_conn_destroy calls fuse_abort_conn. Had the connection not
aborted, the fuse server would have responded to the RELEASE commands by
removing the hidden files; instead they stick around.

For upper-level fuse servers that don't use fuseblk mode this isn't a
problem because libfuse responds to the connection going down by pruning
its inode cache and calling the fuse server's ->release for any open
files before calling the server's ->destroy function.

For fuseblk servers this is a problem, however, because the kernel sends
FUSE_DESTROY to the fuse server, and the fuse server has to close the
block device before returning. This means that the kernel must flush
all pending FUSE_RELEASE requests before issuing FUSE_DESTROY.

Create a function to push all the background requests to the queue and
then wait for the number of pending events to hit zero, and call this
before sending FUSE_DESTROY. That way, all the pending events are
processed by the fuse server and we don't end up with a corrupt
filesystem.

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
fs/fuse/fuse_i.h | 5 +++++
fs/fuse/dev.c | 33 +++++++++++++++++++++++++++++++++
fs/fuse/inode.c | 11 ++++++++++-
3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index cc428d04be3e14..8edca9ad13a9d1 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -1263,6 +1263,11 @@ void fuse_request_end(struct fuse_req *req);
void fuse_abort_conn(struct fuse_conn *fc);
void fuse_wait_aborted(struct fuse_conn *fc);

+/**
+ * Flush all pending requests and wait for them.
+ */
+void fuse_flush_requests_and_wait(struct fuse_conn *fc);
+
/* Check if any requests timed out */
void fuse_check_timeout(struct work_struct *work);

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 5150aa25e64be9..dcd338b65b2fc7 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -24,6 +24,7 @@
#include <linux/splice.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
+#include <linux/nmi.h>

#define CREATE_TRACE_POINTS
#include "fuse_trace.h"
@@ -2385,6 +2386,38 @@ static void end_polls(struct fuse_conn *fc)
}
}

+/*
+ * Flush all pending requests and wait for them. Only call this function when
+ * it is no longer possible for other threads to add requests.
+ */
+void fuse_flush_requests_and_wait(struct fuse_conn *fc)
+{
+ spin_lock(&fc->lock);
+ if (!fc->connected) {
+ spin_unlock(&fc->lock);
+ return;
+ }
+
+ /* Push all the background requests to the queue. */
+ spin_lock(&fc->bg_lock);
+ fc->blocked = 0;
+ fc->max_background = UINT_MAX;
+ flush_bg_queue(fc);
+ spin_unlock(&fc->bg_lock);
+ spin_unlock(&fc->lock);
+
+ /*
+ * Wait for all the events to complete or abort. Touch the watchdog
+ * once per second so that we don't trip the hangcheck timer while
+ * waiting for the fuse server.
+ */
+ smp_mb();
+ while (wait_event_timeout(fc->blocked_waitq,
+ !fc->connected || atomic_read(&fc->num_waiting) == 0,
+ HZ) == 0)
+ touch_softlockup_watchdog();
+}
+
/*
* Abort all requests.
*
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 7ddfd2b3cc9c4f..c94aba627a6f11 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -2056,8 +2056,17 @@ void fuse_conn_destroy(struct fuse_mount *fm)
{
struct fuse_conn *fc = fm->fc;

- if (fc->destroy)
+ if (fc->destroy) {
+ /*
+ * Flush all pending requests (most of which will be
+ * FUSE_RELEASE) before sending FUSE_DESTROY, because the fuse
+ * server must close the filesystem before replying to the
+ * destroy message, because unmount is about to release its
+ * O_EXCL hold on the block device.
+ */
+ fuse_flush_requests_and_wait(fc);
fuse_send_destroy(fm);
+ }

fuse_abort_conn(fc);
fuse_wait_aborted(fc);