[PATCH v1] fuse: use copy_splice_read() for FOPEN_DIRECT_IO splice read

[PATCH v1] fuse: use copy_splice_read() for FOPEN_DIRECT_IO splice read

[Joanne Koong]

When FOPEN_DIRECT_IO is set, fuse_splice_read() calls
filemap_splice_read(), which populates the pipe with pages from the fuse
inode's page cache.

This contradicts FOPEN_DIRECT_IO, which is set by the server to indicate
that the page cache should be bypassed entirely. Subsequent splice reads
can then read stale data from the cache instead of fetching fresh data
from the server.

Use copy_splice_read() instead, which will invoke ->read_iter() on each
splice read, sending a FUSE_READ to the server every time without
populating the page cache.

We do not need to add checking for O_DIRECT since this is already
handled at the vfs layer in do_splice_read().

Fixes: 2cb1e08985e3 ("splice: Use filemap_splice_read() instead of generic_file_splice_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
---
 fs/fuse/file.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 3bdab8d03373..3ebe18ed0264 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1859,7 +1859,9 @@ static ssize_t fuse_splice_read(struct file *in, loff_t *ppos,
 	struct fuse_file *ff = in->private_data;
 
 	/* FOPEN_DIRECT_IO overrides FOPEN_PASSTHROUGH */
-	if (fuse_file_passthrough(ff) && !(ff->open_flags & FOPEN_DIRECT_IO))
+	if (ff->open_flags & FOPEN_DIRECT_IO)
+		return copy_splice_read(in, ppos, pipe, len, flags);
+	else if (fuse_file_passthrough(ff))
 		return fuse_passthrough_splice_read(in, ppos, pipe, len, flags);
 	else
 		return filemap_splice_read(in, ppos, pipe, len, flags);
-- 
2.52.0

Re: [PATCH v1] fuse: use copy_splice_read() for FOPEN_DIRECT_IO splice read

[Amir Goldstein]

On Tue, May 12, 2026 at 10:05 PM Joanne Koong <joannelkoong@gmail.com> wrote:
>
> When FOPEN_DIRECT_IO is set, fuse_splice_read() calls
> filemap_splice_read(), which populates the pipe with pages from the fuse
> inode's page cache.
>
> This contradicts FOPEN_DIRECT_IO, which is set by the server to indicate
> that the page cache should be bypassed entirely.

Generally speaking, this statement is not 100% accurate if you consider
mmap(), so "page cache should be bypassed entirely" is a bit strong,
but I agree that this is a good goal to aspire to.

> Subsequent splice reads
> can then read stale data from the cache instead of fetching fresh data
> from the server.
>
> Use copy_splice_read() instead, which will invoke ->read_iter() on each
> splice read, sending a FUSE_READ to the server every time without
> populating the page cache.
>
> We do not need to add checking for O_DIRECT since this is already
> handled at the vfs layer in do_splice_read().
>
> Fixes: 2cb1e08985e3 ("splice: Use filemap_splice_read() instead of generic_file_splice_read()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>

Reviewed-by: Amir Goldstein <amir73il@gmail.com>

> ---
>  fs/fuse/file.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/fuse/file.c b/fs/fuse/file.c
> index 3bdab8d03373..3ebe18ed0264 100644
> --- a/fs/fuse/file.c
> +++ b/fs/fuse/file.c
> @@ -1859,7 +1859,9 @@ static ssize_t fuse_splice_read(struct file *in, loff_t *ppos,
>         struct fuse_file *ff = in->private_data;
>
>         /* FOPEN_DIRECT_IO overrides FOPEN_PASSTHROUGH */
> -       if (fuse_file_passthrough(ff) && !(ff->open_flags & FOPEN_DIRECT_IO))
> +       if (ff->open_flags & FOPEN_DIRECT_IO)
> +               return copy_splice_read(in, ppos, pipe, len, flags);
> +       else if (fuse_file_passthrough(ff))
>                 return fuse_passthrough_splice_read(in, ppos, pipe, len, flags);
>         else
>                 return filemap_splice_read(in, ppos, pipe, len, flags);
> --
> 2.52.0
>
>