[Devel] [PATCH RHEL10 COMMIT] fs/fuse: fix iocachectr leak on failure in vStorage open

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.30.1.14.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.30.1.14.1.vz10
------>
commit d1f80bb13f853544b276954caca118e8b8c89988
Author: Liu Kui <kui.liu at virtuozzo.com>
Date:   Thu Jul 2 13:07:03 2026 +0800

    fs/fuse: fix iocachectr leak on failure in vStorage open
    
    The vStorage open in close_wait branch runs after fuse_file_io_open() has
    taken the inode io-mode reference. However when fuse_finish_open() returns
    error, its caller tears the file down via fuse_sync_release(), which doesn't
    call fuse_file_io_release() (ra->inode is NULL), leaking iocachectr and
    triggering WARN_ON(fi->iocachectr != 0) in fuse_evict_inode().
    
    Fix the leak by calling fuse_file_io_release() on the failure path.
    
    https://virtuozzo.atlassian.net/browse/VSTOR-136977
    
    Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
    Acked-by: Alexey Kuznetsov <kuznet at virtuozzo.com>
---
 fs/fuse/file.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2855986c987d2..f77c784b938f5 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -353,6 +353,15 @@ int fuse_finish_open(struct inode *inode, struct file *file)
 
 		if (!err)
 			err = fuse_open_close_wait(inode, file);
+
+		/*
+		 * fuse_file_io_open() has already taken the inode io-mode reference
+		 * (fi->iocachectr). On failure the caller tears the file down via
+		 * fuse_sync_release(), which does not call fuse_file_io_release()
+		 * because ra->inode is NULL for synchronous release.
+		 */
+		if (err)
+			fuse_file_io_release(ff, inode);
 	}
 
 	return err;