linux-stable.git/fs/fuse/dev_uring.c, branch v6.14

fuse: fix uring race condition for null dereference of fc

2025-03-19T08:24:03+00:00

There is a race condition leading to a kernel crash from a null
dereference when attemping to access fc->lock in
fuse_uring_create_queue(). fc may be NULL in the case where another
thread is creating the uring in fuse_uring_create() and has set
fc->ring but has not yet set ring->fc when fuse_uring_create_queue()
reads ring->fc. There is another race condition as well where in
fuse_uring_register(), ring->nr_queues may still be 0 and not yet set
to the new value when we compare qid against it.

This fix sets fc->ring only after ring->fc and ring->nr_queues have been
set, which guarantees now that ring->fc is a proper pointer when any
queues are created and ring->nr_queues reflects the right number of
queues if ring is not NULL. We must use smp_store_release() and
smp_load_acquire() semantics to ensure the ordering will remain correct
where fc->ring is assigned only after ring->fc and ring->nr_queues have
been assigned.

Signed-off-by: Joanne Koong 
Link: https://lore.kernel.org/r/20250318003028.3330599-1-joannelkoong@gmail.com
Fixes: 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")
Acked-by: Miklos Szeredi 
Reviewed-by: Bernd Schubert 
Signed-off-by: Christian Brauner

fuse: prevent disabling io-uring on active connections

2025-01-27T17:02:23+00:00

The enable_uring module parameter allows administrators to enable/disable
io-uring support for FUSE at runtime. However, disabling io-uring while
connections already have it enabled can lead to an inconsistent state.

Fix this by keeping io-uring enabled on connections that were already using
it, even if the module parameter is later disabled. This ensures active
FUSE mounts continue to function correctly.

Signed-off-by: Bernd Schubert 
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: enable fuse-over-io-uring

2025-01-27T17:02:23+00:00

All required parts are handled now, fuse-io-uring can
be enabled.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: block request allocation until io-uring init is complete

2025-01-27T17:02:23+00:00

Avoid races and block request allocation until io-uring
queues are ready.

This is a especially important for background requests,
as bg request completion might cause lock order inversion
of the typical queue->lock and then fc->bg_lock

    fuse_request_end
       spin_lock(&fc->bg_lock);
       flush_bg_queue
         fuse_send_one
           fuse_uring_queue_fuse_req
           spin_lock(&queue->lock);

Signed-off-by: Bernd Schubert 
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: {io-uring} Prevent mount point hang on fuse-server termination

2025-01-27T17:02:21+00:00

When the fuse-server terminates while the fuse-client or kernel
still has queued URING_CMDs, these commands retain references
to the struct file used by the fuse connection. This prevents
fuse_dev_release() from being invoked, resulting in a hung mount
point.

This patch addresses the issue by making queued URING_CMDs
cancelable, allowing fuse_dev_release() to proceed as expected
and preventing the mount point from hanging.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: Allow to queue bg requests through io-uring

2025-01-27T17:01:22+00:00

This prepares queueing and sending background requests through
io-uring.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: Allow to queue fg requests through io-uring

2025-01-27T17:01:22+00:00

This prepares queueing and sending foreground requests through
io-uring.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: {io-uring} Handle teardown of ring entries

2025-01-27T17:01:12+00:00

On teardown struct file_operations::uring_cmd requests
need to be completed by calling io_uring_cmd_done().
Not completing all ring entries would result in busy io-uring
tasks giving warning messages in intervals and unreleased
struct file.

Additionally the fuse connection and with that the ring can
only get released when all io-uring commands are completed.

Completion is done with ring entries that are
a) in waiting state for new fuse requests - io_uring_cmd_done
is needed

b) already in userspace - io_uring_cmd_done through teardown
is not needed, the request can just get released. If fuse server
is still active and commits such a ring entry, fuse_uring_cmd()
already checks if the connection is active and then complete the
io-uring itself with -ENOTCONN. I.e. special handling is not
needed.

This scheme is basically represented by the ring entry state
FRRS_WAIT and FRRS_USERSPACE.

Entries in state:
- FRRS_INIT: No action needed, do not contribute to
  ring->queue_refs yet
- All other states: Are currently processed by other tasks,
  async teardown is needed and it has to wait for the two
  states above. It could be also solved without an async
  teardown task, but would require additional if conditions
  in hot code paths. Also in my personal opinion the code
  looks cleaner with async teardown.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: Add io-uring sqe commit and fetch support

2025-01-27T16:36:41+00:00

This adds support for fuse request completion through ring SQEs
(FUSE_URING_CMD_COMMIT_AND_FETCH handling). After committing
the ring entry it becomes available for new fuse requests.
Handling of requests through the ring (SQE/CQE handling)
is complete now.

Fuse request data are copied through the mmaped ring buffer,
there is no support for any zero copy yet.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi

fuse: {io-uring} Handle SQEs - register commands

2025-01-24T10:54:08+00:00

This adds basic support for ring SQEs (with opcode=IORING_OP_URING_CMD).
For now only FUSE_IO_URING_CMD_REGISTER is handled to register queue
entries.

Signed-off-by: Bernd Schubert 
Reviewed-by: Pavel Begunkov  # io_uring
Reviewed-by: Luis Henriques 
Signed-off-by: Miklos Szeredi