<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ack, this is a real bug. </div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Konstantin Khorenko <khorenko@virtuozzo.com><br>
<b>Sent:</b> 06 July 2026 20:39<br>
<b>To:</b> Alexey Kuznetsov <kuznet@virtuozzo.com>; Kui Liu <kui.liu@virtuozzo.com><br>
<b>Cc:</b> vzdevel <devel@openvz.org><br>
<b>Subject:</b> Re: [PATCH vz10 03/24] fuse: also take req_lock when walking open_files in fusectl</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Guys, please, review the patch.<br>
<br>
--<br>
Best regards,<br>
<br>
Konstantin Khorenko,<br>
Virtuozzo Linux Kernel Team<br>
<br>
On 7/6/26 12:59, Konstantin Khorenko wrote:<br>
> Commit 56ef1ee0584c switched the fusectl seq-file iterator from an<br>
> unconditional spin_lock(&fcp->conn->lock) to spin_lock(fcp->req_lock),<br>
> so that each fusectl list is walked under the lock that actually<br>
> protects it. It set ->req_lock for the "pending_req" file (and the<br>
> #if 0 processing/io variants), but missed the second consumer of the<br>
> same start/next/stop callbacks: the "open_files" seq-file has its own<br>
> open handler, fuse_conn_files_open().<br>
> <br>
> fuse_conn_priv is allocated with __seq_open_private() (kzalloc), so for<br>
> open_files ->req_lock stayed NULL. The first read of<br>
> /sys/fs/fuse/connections/<dev>/open_files then calls fuse_req_start()<br>
> -> spin_lock(NULL) and the kernel panics with a NULL pointer<br>
> dereference in the qspinlock slow path.<br>
> <br>
> The conn_files list is added to and removed from under conn->lock<br>
> (fuse_file_alloc()/fuse_file_list_del()), so point ->req_lock at<br>
> conn->lock for the open_files file too. This restores the exact lock<br>
> that was used before 56ef1ee0584c for this path.<br>
> <br>
> Fixes: 56ef1ee0584c ("fuse: lock the input-queue lock when walking pending_req in fusectl")<br>
> Feature: vStorage<br>
> <a href="https://virtuozzo.atlassian.net/browse/VSTOR-137234">https://virtuozzo.atlassian.net/browse/VSTOR-137234</a><br>
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com><br>
> ---<br>
> fs/fuse/control.c | 1 +<br>
> 1 file changed, 1 insertion(+)<br>
> <br>
> diff --git a/fs/fuse/control.c b/fs/fuse/control.c<br>
> index 1f5d998be23d..6d210ac80610 100644<br>
> --- a/fs/fuse/control.c<br>
> +++ b/fs/fuse/control.c<br>
> @@ -441,6 +441,7 @@ static int fuse_conn_files_open(struct inode *inode, struct file *filp)<br>
> <br>
> fcp->conn = conn;<br>
> fcp->req_list = &conn->conn_files;<br>
> + fcp->req_lock = &conn->lock;<br>
> return 0;<br>
> }<br>
> <br>
<br>
</div>
</span></font></div>
</body>
</html>