[Devel] [PATCH hci-8.0] fs/fuse: fix writectr imbalance when failing writeback of invalidated file

[Liu Kui]

The shoot-on-sight path in fuse_writepages_send() for files being
invalidated violates the writectr protocol: the increment is not
gated on writectr >=0, and the matching decrement lives in a separate
fi->lock critical section. A concurrent fuse_set_nowrite() and
fuse_release_nowrite() pair lands in that window observes writectr ==
FUSE_NOWRITE + 1 and triggers BUG_ON(fi->writectr != FUSE_NOWRITE) in
__fuse_release_nowrite():

  kernel BUG at fs/fuse/dir.c:1842!
  RIP: fuse_release_nowrite+0x45/0x50 [fuse]
   fuse_release+0xd0/0x300 [fuse]
   __fput+0xe1/0x2a0
   __x64_sys_close+0x3c/0x80

Fix it by always routing writeback through fi->queued_writes so the
writectr gating applies, and failing requests on invalidated files
in fuse_send_writepage() instead, where the existing out_free path
keeps the writectr increment and decrement balanced within a single
fi->lock critical section. Note that if a NOWRITE section is active,
queue the request instead of failing it immediately is harmless for
the file invalidation operation.

https://virtuozzo.atlassian.net/browse/VSTOR-145614

Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
---
Fix a writectr protocol violation in the shoot-on-sight writeback path
for invalidated files, which races with fuse_set_nowrite()/
fuse_release_nowrite() and triggers BUG_ON(fi->writectr != FUSE_NOWRITE)
in __fuse_release_nowrite() (vmcore analysis in VSTOR-145614).

https://virtuozzo.atlassian.net/browse/VSTOR-145614
---
 fs/fuse/file.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c96a631b9529..180f60fc539a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2237,6 +2237,11 @@ __acquires(fi->lock)
 	int err;
 
 	fi->writectr++;
+	if (fuse_file_fail_immediately(wpa->ia.ff)) {
+		/* File is under invalidation: fail request without sending */
+		mapping_set_error(wpa->inode->i_mapping, -EIO);
+		goto out_free;
+	}
 	if (inarg->offset + data_size <= size) {
 		inarg->size = data_size;
 	} else if (inarg->offset < size) {
@@ -2619,28 +2624,17 @@ static void fuse_writepages_send(struct fuse_fill_wb_data *data)
 {
 	struct fuse_writepage_args *wpa = data->wpa;
 	struct inode *inode = data->inode;
-	struct fuse_mount *fm = get_fuse_mount(inode);
 	struct fuse_inode *fi = get_fuse_inode(inode);
 	int num_pages = wpa->ia.ap.num_pages;
-	struct fuse_args *args = &wpa->ia.ap.args;
-	int shoot_on_sight = 0;
 	int i;
 
 	spin_lock(&fi->lock);
-	if (fuse_file_fail_immediately(data->ff)) {
-		shoot_on_sight = 1;
-		fi->writectr++;
-	} else {
-		list_add_tail(&wpa->queue_entry, &fi->queued_writes);
-		fuse_flush_writepages(inode);
-	}
+	list_add_tail(&wpa->queue_entry, &fi->queued_writes);
+	fuse_flush_writepages(inode);
 	spin_unlock(&fi->lock);
 
 	for (i = 0; i < num_pages; i++)
 		end_page_writeback(data->orig_pages[i]);
-
-	if (shoot_on_sight)
-		args->end(fm, args, -EIO);
 }
 
 /*

---
base-commit: 397370a45ebb33b582fe6e5c0b2240cc4edb7bc9
change-id: 20260918-vstor-145614-writectr-17baf632e5b7

Best regards,
--  
Liu Kui <kui.liu at virtuozzo.com>