linux-stable.git/fs/fuse/dev_uring_i.h, branch v7.2.4

fuse: decouple fuse_ring creation from ent registration

2026-09-07T15:37:25+00:00

[ Upstream commit 6330b1f61ed1d17850fc61bdb8920ca1056e2cf9 ]

Currently, the connection's fuse_ring is created lazily on the first
FUSE_IO_URING_CMD_REGISTER command. A server registers entries from one
thread per queue (one per CPU) and those threads issue their first
REGISTER command concurrently. They then race to create the single
per-connection fuse_ring, which required open-coded handling in
fuse_uring_create() to detect and protect against concurrent creations.

Decouple fuse_ring creation from ent registration and move it to
FUSE_INIT reply processing after a server has negotiated and set
FUSE_OVER_IO_URING. The ring is published before the connection is
marked initialized. fuse_uring_register() no longer creates the ring and
it instead uses the ring set up at init time.

Reviewed-by: Bernd Schubert 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi 
Stable-dep-of: fd10f40af314 ("fuse: copy request headers via a stack buffer for io-uring")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

fuse-uring: drop kernel-doc notation for a comment

2026-06-15T12:06:18+00:00

Use regular C comment syntax for a non-kernel-doc comment to avoid
a kernel-doc warning:

Warning: fs/fuse/dev_uring_i.h:104 This comment starts with '/**', but
 isn't a kernel-doc comment.
 * Describes if uring is for communication and holds alls the data needed

Binary build output is the same before and after this change.

Signed-off-by: Randy Dunlap 
Signed-off-by: Miklos Szeredi

fuse: change ring->fc to ring->chan

2026-06-15T12:06:18+00:00

Store pointer to struct fuse_chan instead of struct fuse_conn in fuse_ring.

Signed-off-by: Miklos Szeredi

fuse: remove #include "fuse_i.h" from "dev_uring_i.h"

2026-06-15T12:06:16+00:00

Start getting rid of fs layer stuff from transport layer files.

Signed-off-by: Miklos Szeredi

fuse: don't access transport layer structs directly from the fs layer

2026-06-15T12:06:16+00:00

Add helpers (get and set functions mainly) that cleanly separate the
layers.

Remove #include "fuse_dev_i.h" from:

 - inode.c
 - file.c
 - control.c

Remove #include "dev_uring_i.h" from inode.c.

[Li Wang: drop redundant initializer in process_init_limits()]

Signed-off-by: Miklos Szeredi

fuse: move request timeout to fuse_chan

2026-06-15T12:06:16+00:00

Move:

 - timeout

Signed-off-by: Miklos Szeredi

fuse: move io_uring related members to fuse_chan

2026-06-15T12:06:16+00:00

Move:

 - io_uring
 - ring

Signed-off-by: Miklos Szeredi

fuse: move fuse_iqueue to fuse_chan

2026-06-15T12:06:15+00:00

Move the 'fiq' member from fuse_conn to fuse_chan.

Move iqueue related structure definitions and function declarations from
"fuse_i.h" to "fuse_dev_i.h".

Add a fuse_dev_chan_new() helper, that returns a fuse_chan initialized with
the fuse_dev_fiq_ops.

Add a fuse_chan_release() function, that calls fiq->ops->release().

Signed-off-by: Miklos Szeredi

fuse-uring: fix moving cancelled entry to ent_in_userspace list

2026-06-15T12:06:14+00:00

fuse_uring_cancel() moves entries that are available (these have no reqs
attached) to the ent_in_userspace list. ent_list_request_expired()
checks the first entry on ent_in_userspace and dereferences
ent->fuse_req unconditionally, which will crash on a cancelled entry
that was moved to this list.

Fix this by freeing the entry and dropping queue_refs directly in
fuse_uring_cancel(). This is safe because cancel is the cancel handler
itself - after io_uring_cmd_done(), no more cancels will be dispatched
for this command, and teardown serializes with cancel via queue->lock.

Since cancel now decrements queue_refs, fuse_uring_abort() must no
longer gate fuse_uring_abort_end_requests() on queue_refs > 0, as
cancelled entries may have already dropped queue_refs while requests are
still queued. Remove the gate so abort always flushes requests and stops
queues.

Reported-by: Heechan Kang 
Tested-by: Heechan Kang 
Reviewed-by: Bernd Schubert 
Fixes: 4fea593e625c ("fuse: optimize over-io-uring request expiration check")
Cc: stable@vger.kernel.org
Suggested-by: Jian Huang Li 
Suggested-by: Horst Birthelmer 
Signed-off-by: Joanne Koong 
Signed-off-by: Miklos Szeredi

fuse-uring: fix data races on ring->ready

2026-06-15T12:06:13+00:00

On weakly-ordered architectures, the store to fiq->ops can be
reordered past the store to ring->ready, allowing a CPU that sees
ring->ready == true via fuse_uring_ready() to dispatch requests
through a stale fiq->ops pointer. Upgrade the store to
smp_store_release() and the load in fuse_uring_ready() to
smp_load_acquire() so that the preceding WRITE_ONCE(fiq->ops, ...)
is visible to any CPU that observes ring->ready == true.

Additionally, fuse_uring_do_register() publishes ring->ready with
WRITE_ONCE() but the fast-path check reads it with a plain load.
This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in
READ_ONCE() to mark it without adding unnecessary ordering.

Also wrap the fc->ring load in fuse_uring_ready() in READ_ONCE() to
prevent the compiler from reloading it between the NULL check and the
dereference.

Fixes: c2c9af9a0b13 ("fuse: Allow to queue fg requests through io-uring")
Cc: stable@vger.kernel.org
Reviewed-by: Joanne Koong 
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason 
Reviewed-by: Bernd Schubert 
Signed-off-by: Miklos Szeredi