linux.git/fs/fuse/file.c, branch v6.14

fuse: revert back to __readahead_folio() for readahead

2025-02-14T09:49:23+00:00

In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the
logic was converted to using the new folio readahead code, which drops
the reference on the folio once it is locked, using an inferred
reference on the folio. Previously we held a reference on the folio for
the entire duration of the readpages call.

This is fine, however for the case for splice pipe responses where we
will remove the old folio and splice in the new folio (see
fuse_try_move_page()), we assume that there is a reference held on the
folio for ap->folios, which is no longer the case.

To fix this, revert back to __readahead_folio() which allows us to hold
the reference on the folio for the duration of readpages until either we
drop the reference ourselves in fuse_readpages_end() or the reference is
dropped after it's replaced in the page cache in the splice case.
This will fix the UAF bug that was reported.

Link: https://lore.kernel.org/linux-fsdevel/2f681f48-00f5-4e09-8431-2b3dbfaa881e@heusel.eu/
Fixes: 3eab9d7bc2f4 ("fuse: convert readahead to use folios")
Reported-by: Christian Heusel 
Closes: https://lore.kernel.org/all/2f681f48-00f5-4e09-8431-2b3dbfaa881e@heusel.eu/
Closes: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/110
Reported-by: Mantas Mikulėnas 
Closes: https://lore.kernel.org/all/34feb867-09e2-46e4-aa31-d9660a806d1a@gmail.com/
Closes: https://bugzilla.opensuse.org/show_bug.cgi?id=1236660
Cc:  # v6.13
Signed-off-by: Joanne Koong 
Reviewed-by: Jeff Layton 
Signed-off-by: Miklos Szeredi

fuse: Set *nbytesp=0 in fuse_get_user_pages on allocation failure

2024-12-13T15:43:36+00:00

In fuse_get_user_pages(), set *nbytesp to 0 when struct page **pages
allocation fails. This prevents the caller (fuse_direct_io) from making
incorrect assumptions that could lead to NULL pointer dereferences
when processing the request reply.

Previously, *nbytesp was left unmodified on allocation failure, which
could cause issues if the caller assumed pages had been added to
ap->descs[] when they hadn't.

Reported-by: syzbot+87b8e6ed25dbc41759f7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87b8e6ed25dbc41759f7
Fixes: 3b97c3652d91 ("fuse: convert direct io to use folios")
Signed-off-by: Bernd Schubert 
Reviewed-by: Joanne Koong 
Tested-by: Dmitry Antipov 
Tested-by: David Howells 
Signed-off-by: Miklos Szeredi

fuse: fix direct io folio offset and length calculation

2024-12-12T08:27:42+00:00

For the direct io case, the pages from userspace may be part of a huge
folio, even if all folios in the page cache for fuse are small.

Fix the logic for calculating the offset and length of the folio for
the direct io case, which currently incorrectly assumes that all folios
encountered are one page size.

Fixes: 3b97c3652d91 ("fuse: convert direct io to use folios")
Signed-off-by: Joanne Koong 
Reviewed-by: Jingbo Xu 
Reviewed-by: Bernd Schubert 
Signed-off-by: Miklos Szeredi

fuse: remove pages for requests and exclusively use folios

2024-11-05T13:08:35+00:00

All fuse requests use folios instead of pages for transferring data.
Remove pages from the requests and exclusively use folios.

No functional changes.

[SzM: rename back folio_descs -> descs, etc.]

Signed-off-by: Joanne Koong 
Reviewed-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: convert direct io to use folios

2024-11-05T10:14:32+00:00

Convert direct io requests to use folios instead of pages.

No functional changes.

Signed-off-by: Joanne Koong 
Reviewed-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: convert writebacks to use folios

2024-11-05T10:14:32+00:00

Convert writeback requests to use folios instead of pages.

No functional changes.

Signed-off-by: Joanne Koong 
Reviewed-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: convert writes (non-writeback) to use folios

2024-11-05T10:14:32+00:00

Convert non-writeback write requests to use folios instead of pages.

No functional changes.

Signed-off-by: Joanne Koong 
Reviewed-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: convert reads to use folios

2024-11-05T10:14:32+00:00

Convert read requests to use folios instead of pages.

No functional changes.

Signed-off-by: Joanne Koong 
Reviewed-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: use the folio based vmstat helpers

2024-10-25T15:05:50+00:00

In order to make it easier to switch to folios in the fuse_args_pages
update the places where we update the vmstat counters for writeback to
use the folio related helpers.  On the inc side this is easy as we
already have the folio, on the dec side we have to page_folio() the
pages for now.

Reviewed-by: Joanne Koong 
Signed-off-by: Josef Bacik 
Signed-off-by: Miklos Szeredi

fuse: convert fuse_writepage_need_send to take a folio

2024-10-25T15:05:49+00:00

fuse_writepage_need_send is called by fuse_writepages_fill() which
already has a folio.  Change fuse_writepage_need_send() to take a folio
instead, add a helper to check if the folio range is under writeback and
use this, as well as the appropriate folio helpers in the rest of the
function.  Update fuse_writepage_need_send() to pass in the folio
directly.

Reviewed-by: Joanne Koong 
Signed-off-by: Josef Bacik 
Signed-off-by: Miklos Szeredi