[Devel] [PATCH hci-8.0] fs/fuse: fix writectr imbalance when failing writeback of invalidated file

[Alexey Kuznetsov]

Ack

On Fri, Sep 18, 2026 at 6:41 PM Liu Kui <kui.liu at virtuozzo.com> wrote:
>
> The shoot-on-sight path in fuse_writepages_send() for files being
> invalidated violates the writectr protocol: the increment is not
> gated on writectr >=0, and the matching decrement lives in a separate
> fi->lock critical section. A concurrent fuse_set_nowrite() and
> fuse_release_nowrite() pair lands in that window observes writectr ==
> FUSE_NOWRITE + 1 and triggers BUG_ON(fi->writectr != FUSE_NOWRITE) in
> __fuse_release_nowrite():
>
>   kernel BUG at fs/fuse/dir.c:1842!
>   RIP: fuse_release_nowrite+0x45/0x50 [fuse]
>    fuse_release+0xd0/0x300 [fuse]
>    __fput+0xe1/0x2a0
>    __x64_sys_close+0x3c/0x80
>
> Fix it by always routing writeback through fi->queued_writes so the
> writectr gating applies, and failing requests on invalidated files
> in fuse_send_writepage() instead, where the existing out_free path
> keeps the writectr increment and decrement balanced within a single
> fi->lock critical section. Note that if a NOWRITE section is active,
> queue the request instead of failing it immediately is harmless for
> the file invalidation operation.
>
> https://virtuozzo.atlassian.net/browse/VSTOR-145614
>
> Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
> ---
> Fix a writectr protocol violation in the shoot-on-sight writeback path
> for invalidated files, which races with fuse_set_nowrite()/
> fuse_release_nowrite() and triggers BUG_ON(fi->writectr != FUSE_NOWRITE)
> in __fuse_release_nowrite() (vmcore analysis in VSTOR-145614).
>
> https://virtuozzo.atlassian.net/browse/VSTOR-145614
> ---
>  fs/fuse/file.c | 20 +++++++-------------
>  1 file changed, 7 insertions(+), 13 deletions(-)
>
> diff --git a/fs/fuse/file.c b/fs/fuse/file.c
> index c96a631b9529..180f60fc539a 100644
> --- a/fs/fuse/file.c
> +++ b/fs/fuse/file.c
> @@ -2237,6 +2237,11 @@ __acquires(fi->lock)
>         int err;
>
>         fi->writectr++;
> +       if (fuse_file_fail_immediately(wpa->ia.ff)) {
> +               /* File is under invalidation: fail request without sending */
> +               mapping_set_error(wpa->inode->i_mapping, -EIO);
> +               goto out_free;
> +       }
>         if (inarg->offset + data_size <= size) {
>                 inarg->size = data_size;
>         } else if (inarg->offset < size) {
> @@ -2619,28 +2624,17 @@ static void fuse_writepages_send(struct fuse_fill_wb_data *data)
>  {
>         struct fuse_writepage_args *wpa = data->wpa;
>         struct inode *inode = data->inode;
> -       struct fuse_mount *fm = get_fuse_mount(inode);
>         struct fuse_inode *fi = get_fuse_inode(inode);
>         int num_pages = wpa->ia.ap.num_pages;
> -       struct fuse_args *args = &wpa->ia.ap.args;
> -       int shoot_on_sight = 0;
>         int i;
>
>         spin_lock(&fi->lock);
> -       if (fuse_file_fail_immediately(data->ff)) {
> -               shoot_on_sight = 1;
> -               fi->writectr++;
> -       } else {
> -               list_add_tail(&wpa->queue_entry, &fi->queued_writes);
> -               fuse_flush_writepages(inode);
> -       }
> +       list_add_tail(&wpa->queue_entry, &fi->queued_writes);
> +       fuse_flush_writepages(inode);
>         spin_unlock(&fi->lock);
>
>         for (i = 0; i < num_pages; i++)
>                 end_page_writeback(data->orig_pages[i]);
> -
> -       if (shoot_on_sight)
> -               args->end(fm, args, -EIO);
>  }
>
>  /*
>
> ---
> base-commit: 397370a45ebb33b582fe6e5c0b2240cc4edb7bc9
> change-id: 20260918-vstor-145614-writectr-17baf632e5b7
>
> Best regards,
> --
> Liu Kui <kui.liu at virtuozzo.com>