linux-kernel - Re: [PATCH] fuse: send forget req when lookup outarg is invalid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4f66008e-228f-4e49-a860-314dd82116ad@bsbernd.com>
Date: Tue, 3 Feb 2026 19:33:28 +0100
From: Bernd Schubert <bernd@...ernd.com>
To: Zhang Tianci <zhangtianci.1997@...edance.com>, miklos@...redi.hu
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
 Xie Yongji <xieyongji@...edance.com>
Subject: Re: [PATCH] fuse: send forget req when lookup outarg is invalid



On 2/2/26 13:00, Zhang Tianci wrote:
> We shall send forget request if lookup/create/open success but returned
> outarg.attr is invalid, because FUSEdaemon had increase the lookup count
> 
> Reported-by: Xie Yongji <xieyongji@...edance.com>
> Signed-off-by: Zhang Tianci <zhangtianci.1997@...edance.com>
> ---
>  fs/fuse/dir.c | 18 +++++++++++++-----
>  1 file changed, 13 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
> index 4b6b3d2758ff2..92a10fe2c4825 100644
> --- a/fs/fuse/dir.c
> +++ b/fs/fuse/dir.c
> @@ -578,8 +578,10 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name
>  		goto out_put_forget;
>  
>  	err = -EIO;
> -	if (fuse_invalid_attr(&outarg->attr))
> +	if (fuse_invalid_attr(&outarg->attr)) {
> +		fuse_queue_forget(fm->fc, forget, outarg->nodeid, 1);
>  		goto out_put_forget;

goto out?


> +	}
>  	if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) {
>  		pr_warn_once("root generation should be zero\n");
>  		outarg->generation = 0;
> @@ -879,9 +881,13 @@ static int fuse_create_open(struct mnt_idmap *idmap, struct inode *dir,
>  		goto out_free_ff;
>  
>  	err = -EIO;
> -	if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) ||
> -	    fuse_invalid_attr(&outentry.attr))
> +	if (invalid_nodeid(outentry.nodeid))
> +		goto out_free_ff;
> +
> +	if (!S_ISREG(outentry.attr.mode) || fuse_invalid_attr(&outentry.attr)) {
> +		fuse_queue_forget(fm->fc, forget, outentry.nodeid, 1);
>  		goto out_free_ff;

goto out_err? fuse_sync_release()?

> +	}
>  
>  	ff->fh = outopenp->fh;
>  	ff->nodeid = outentry.nodeid;
> @@ -1007,11 +1013,13 @@ static struct dentry *create_new_entry(struct mnt_idmap *idmap, struct fuse_moun
>  		goto out_put_forget_req;
>  
>  	err = -EIO;
> -	if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr))
> +	if (invalid_nodeid(outarg.nodeid))
>  		goto out_put_forget_req;
>  
> -	if ((outarg.attr.mode ^ mode) & S_IFMT)
> +	if (fuse_invalid_attr(&outarg.attr) || ((outarg.attr.mode ^ mode) & S_IFMT)) {
> +		fuse_queue_forget(fm->fc, forget, outarg.nodeid, 1);
>  		goto out_put_forget_req;

Same here. Might make sense to add a new goto target.

> +	}
>  
>  	inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
>  			  &outarg.attr, ATTR_TIMEOUT(&outarg), 0, 0);



Thanks,
Bernd