[Devel] [PATCH hci-8.0] fs/fuse: fix fuse file refcount leak on close_wait writeback

[Konstantin Khorenko]

On 9/22/26 15:53, Liu Kui wrote:
> Mainline commit 4046d3adcca4 ("fuse: move fuse file initialization to
> wpa allocation time") moved acquisition of the wpa's fuse file
> reference from submit time (fuse_writepages_send) to wpa allocation
> time, and compensated by dropping the reference unconditionally in
> fuse_writepage_free().
> 
> This breaks the close_wait accounting in the vz tree, which splits the
> drop between two functions: fuse_writepage_finish() does
> __fuse_file_put() for close_wait (allowing fuse_release() to pass
> wait_event(ff->count == 1)), while fuse_writepage_free() puts the
> reference only for !close_wait. This split requires that every wpa
> owning a reference passes through fuse_writepage_finish() before being
> freed. Two paths free a wpa without calling it:
> 
>   - fuse_writepage_add(): temp page swap case frees the new wpa
>   - fuse_send_writepage(): out_free path frees the aux request chain
> 
> Before that commit these paths only ever saw wpas with ia.ff == NULL
> (never submitted or promoted), so nothing leaked. After it, every wpa
> owns a reference from birth, and on close_wait mounts both paths leak
> it: ff->count never returns to 1, fuse_release() hangs forever in
> wait_event(), and the fuse file and its FUSE_RELEASE are leaked.
> 
> Fix it by reverting to the old ownership model for the writeback path:
> a wpa is allocated with ia.ff = NULL and acquires the reference at
> submit time (fuse_writepages_send, fuse_writepage_locked) or at aux
> promotion time (fuse_writepage_end). Also make fuse_writepage_free()
> derive fuse_conn from wpa->inode since ia.ff may now legitimately be
> NULL there.
> 
> Note: this is effectively a revert of the mainline change for the
> writeback path. It can be restored later on a rework of the close_wait
> accounting (e.g. dropping the finish/free split in favour of an
> unconditional put).
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-145614

  Fixes: 6b5ddd8253eb ("fuse: Wait for real writeback to finish on file")
  Feature: vStorage

?