linux-stable.git/fs/fuse/dev_uring.c, branch v7.2.4

fuse: copy request headers via a stack buffer for io-uring

2026-09-07T15:37:25+00:00

[ Upstream commit fd10f40af314f07b6d6e028b1ca25c8b49903aab ]

The fuse-io-uring transport copies req->in.h out to the ring in
fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit().
Both headers live inside the fuse_request slab object, whose cache
(fuse_req_cachep) is created without a usercopy whitelist, so copying
them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and
panics:

  usercopy: Kernel memory exposure attempt detected from SLUB object
  'fuse_request' (offset 56, size 40)!
  kernel BUG at mm/usercopy.c:102!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:usercopy_abort (mm/usercopy.c:90)
  Call Trace:
   __check_heap_object (mm/slub.c:8268)
   __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)
   copy_header_to_ring (fs/fuse/dev_uring.c:618)
   fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)
   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)
   tctx_task_work_run (io_uring/tw.c:96)
   task_work_run (kernel/task_work.c:233)
   io_run_task_work (io_uring/tw.h:84)
   io_cqring_wait (io_uring/wait.c:278)
   __do_sys_io_uring_enter (io_uring/io_uring.c:2685)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Bounce both headers through an on-stack copy so the usercopy touches
stack memory, not the slab object.

Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi 
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei 
Reviewed-by: Bernd Schubert 
Reviewed-by: Joanne Koong 
Signed-off-by: Miklos Szeredi 
[ adapted context due to a pre-existing local `ring` local variable from an earlier already-backported commit shifting line numbers ]
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

fuse: decouple fuse_ring creation from ent registration

2026-09-07T15:37:25+00:00

[ Upstream commit 6330b1f61ed1d17850fc61bdb8920ca1056e2cf9 ]

Currently, the connection's fuse_ring is created lazily on the first
FUSE_IO_URING_CMD_REGISTER command. A server registers entries from one
thread per queue (one per CPU) and those threads issue their first
REGISTER command concurrently. They then race to create the single
per-connection fuse_ring, which required open-coded handling in
fuse_uring_create() to detect and protect against concurrent creations.

Decouple fuse_ring creation from ent registration and move it to
FUSE_INIT reply processing after a server has negotiated and set
FUSE_OVER_IO_URING. The ring is published before the connection is
marked initialized. fuse_uring_register() no longer creates the ring and
it instead uses the ring set up at init time.

Reviewed-by: Bernd Schubert 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi 
Stable-dep-of: fd10f40af314 ("fuse: copy request headers via a stack buffer for io-uring")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

fuse: publish io-uring queues with release semantics

2026-09-02T12:33:18+00:00

commit 42df916e5a5f8fb4b60c8cefb54318d1ec02c580 upstream.

fuse_uring_create_queue() initializes a fuse_ring_queue and then
publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the
fch->lock. There are several readers that may concurrently be fetching
that pointer locklessly and then deferencing it.

WRITE_ONCE() doesn't ensure ordering of the queue's field
initialization before the ring->queues[qid] pointer assignment. The
queue must be published with smp_store_release() so the field
initialization is guaranteed to happen before.

Readers in paths where the read may happen concurrently with the store
need to use READ_ONCE() because any race involving a plain access is
undefined.

Fixes: 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands")
Cc: stable@vger.kernel.org
Reviewed-by: Bernd Schubert 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi 
Signed-off-by: Greg Kroah-Hartman

fuse-uring: clear ent->fuse_req in commit_fetch error path

2026-06-15T12:19:45+00:00

fuse_uring_commit_fetch() error path called fuse_request_end(req) without
clearing ent->fuse_req when fuse_ring_ent_set_commit() fails. The
still-pending fuse_uring_send_in_task() task-work later dereferences the
dangling pointer through fuse_uring_prepare_send(), causing a
use-after-free.

End the request with fuse_uring_req_end(), which handles all conditions
already.

Annotation/edition by Bernd: The UAF should be fixed by other means already
and actually has to be avoided that way.
Just checking for ent->fuse_req == NULL in fuse_uring_send_in_task()
would be prone to race conditions, because if malicious userspace
would commit requests that have passed the NULL check, but are
in doing args copy, it would still trigger a use-after-free.
Setting ent->fuse_req = NULL in fuse_uring_commit_fetch() still
makes sense, though.

Reported-by: Shuvam Pandey 
Reported-by: Berkant Koc 
Signed-off-by: Zhenghang Xiao 
Signed-off-by: Bernd Schubert 
Reviewed-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: use named constants for io-uring iovec indices

2026-06-15T12:06:21+00:00

Replace magic indices 0 and 1 for the iovec array with named constants
FUSE_URING_IOV_HEADERS and FUSE_URING_IOV_PAYLOAD. This makes the usages
self-documenting and prepares for buffer ring support which will also
reference these iovec slots by index.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: refactor setting up copy state for payload copying

2026-06-15T12:06:20+00:00

Add a new helper function setup_fuse_copy_state() to contain the logic
for setting up the copy state for payload copying.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: use enum types for header copying

2026-06-15T12:06:20+00:00

Use enum types to identify which part of the header needs to be copied.
This improves the interface and will simplify both kernel-space and
user-space header addresses copying when buffer rings are added.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: refactor io-uring header copying from ring

2026-06-15T12:06:20+00:00

Move header copying from ring logic into a new copy_header_from_ring()
function. This makes the copy_from_user() logic more clear and
centralizes error handling / rate-limited logging.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: refactor io-uring header copying to ring

2026-06-15T12:06:20+00:00

Move header copying to ring logic into a new copy_header_to_ring()
function. This makes the copy_to_user() logic more clear and centralizes
error handling / rate-limited logging.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: separate next request fetching from sending logic

2026-06-15T12:06:20+00:00

Simplify the logic for fetching + sending off the next request.

This gets rid of fuse_uring_send_next_to_ring() which contained
duplicated logic from fuse_uring_send(). This decouples request fetching
from the send operation, which makes the control flow clearer and
reduces unnecessary parameter passing.

Reviewed-by: Bernd Schubert 
Reviewed-by: Jeff Layton 
Reviewed-by: Baokun Li 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi