> The request timeout is implemented by aborting the connection:
> fuse_check_timeout() calls fuse_chan_abort(), which splices
> fpq->processing onto a local list and ends those requests. Ending a
> request wakes the waiting caller, which then drops the last reference and
> frees it.
>
> That is safe for /dev/fuse, where the request has already been copied out
> to userspace and nothing outside the kernel retains a pointer to it. It
> is not safe for virtiofs. virtio_fs_enqueue_req() passes the bare req as
> the virtqueue token, and the scatterlists point at req->in.h, req->out.h,
> req->argbuf and the request's folios; the device still owns all of that
> after the abort. When the device eventually completes the request,
> virtio_fs_requests_done_work() gets the freed req back from
> virtqueue_get_buf() and passes it to virtio_fs_verify_response() and
> virtio_fs_request_complete(), which dereference req->args - the caller's
> [ ... ]
>
> Fixes: 0f6439f61a6e ("fuse: add kernel-enforced timeout option for requests")
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/bug/linux-8171ebf0-ef01-4ccd-943e-8633a8d54239
> Signed-off-by: Miklos Szeredi <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=2
