Re: Re: Re: Re: [PATCH 0/2] fuse: Fix possible memleak at startup with immediate teardown

[Horst Birthelmer <horst@birthelmer.de>]

On Fri, Apr 10, 2026 at 01:09:36PM -0700, Joanne Koong wrote:
> 
> Gotcha, thanks for clarifying.
> 
> Without the original patch, can queue_refs still be 0 by the time
> fuse_abort_conn() is called? The only case where I see that is when
> the sqes are in the middle of being registered but haven't grabbed the
> queue ref yet, and then the abort logic runs (I am going to write more
> about this race in a reply to Bernd's other message in this thread),
> but other than that I don't see how without the original patch we run
> into this case since teardown -> queue ref decrement only happens in
> fuse_uring_stop_list_entries() which only is triggered on the abort
> path. Are you talking about a subsequent fuse_abort_conn() call (the
> one called from fuse_dev_release())?
> 

To your first question if this can happen without the patch.
I have not seen it but the async teardown of the entry could run before
fuse_abort_conn() could it not?

With the patch the stack usually looks something like

Daemon Process Exit
  └─> io_uring_task_cancel()
      └─> io_uring_cancel_generic(true, NULL)
          └─> io_uring_try_cancel_requests(ctx, current, true)
              └─> io_uring_try_cancel_uring_cmd(ctx, task, true) 
                  └─> file->f_op->uring_cmd(cmd, IO_URING_F_CANCEL) 
                      └─> fuse_uring_cmd(cmd, IO_URING_F_CANCEL) 
                          └─> fuse_uring_cancel(cmd, issue_flags)
                              └─> fuse_uring_entry_teardown(ent, issue_flags) 

And this runs before fuse_abort_conn().

Without the patch fuse_uring_cancel() does not call fuse_uring_entry_teardown() directly.
You are completely right in the current version there is no other call to 
fuse_uring_stop_queues() than the one in Fuse_uring_abort().

So yes, without the modification there is no way queue_refs == 0 by the time
fuse_abort_conn() runs.

To your second question. 
Yes I meant fuse_dev_release().

> 
> Thanks,
> Joanne
> >

Thanks,
Horst