Re: [PATCH v1 1/3] fuse: fix race between ring creation and connection abortion

[Bernd Schubert <bernd@bsbernd.com>]

On 5/15/26 06:55, Joanne Koong wrote:
> This fixes this race:
> - thread a: fuse_uring_cmd() gets called, passes fch->connected check
>   (connection abortion not yet triggered)
> - thread b: abort is called, calls fuse_uring_abort(),
> fuse_uring_abort() is a no-op since ring == NULL right now
> - thread a: creates ring, creates queue, creates entry
> 
> which results in
> - leaked ring, queue, ent
> - if thread a increments queue_refs before thread b calls
>   fuse_chan_wait_aborted(), then fuse_chan_wait_aborted() calls
>   "wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);"
>   which will hang the abort/unmount thread indefinitely in unkillable
>   state, as nothing will decrement queue_refs or wake stop_waitq.
> 
> Fix this by checking fch->connected under fch->lock in
> fuse_uring_create() before publishing the ring via
> smp_store_release(&fch->ring, ring) under the same lock scope.

We had this discussion before, I still think it is covered by 2nd patch
"fuse: fix race between registration and connection abortion", because

fuse_uring_destruct() is called by delayed_release() in inode.c and that
is only called when there is nothing accessing /dev/fuse anymore.

The follow-up patch also handles ring->queue_refs going to 0.

From my point of view, what this patch really does is to avoid ring and
queue creation overhead when the connection is going down anyway, so
just the commit message is a bit confusing.

> 
> Fixes: 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  fs/fuse/dev_uring.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
> index e467b23e6895..cd75f61018ec 100644
> --- a/fs/fuse/dev_uring.c
> +++ b/fs/fuse/dev_uring.c
> @@ -244,6 +244,10 @@ static struct fuse_ring *fuse_uring_create(struct fuse_chan *fch)
>  	max_payload_size = max(max_payload_size, fch->max_pages * PAGE_SIZE);
>  
>  	spin_lock(&fch->lock);
> +	if (!fch->connected) {
> +		spin_unlock(&fch->lock);
> +		goto out_err;
> +	}
>  	if (fch->ring) {
>  		/* race, another thread created the ring in the meantime */
>  		spin_unlock(&fch->lock);


Reviewed-by: Bernd Schubert <bernd@bsbernd.com>