Re: WARN_ON(fuse_insert_writeback(root, wpa)) in tree_insert()

[Miklos Szeredi <miklos@szeredi.hu>]

[-- Attachment #1: Type: text/plain, Size: 651 bytes --]

On Thu, Oct 29, 2020 at 4:02 PM Qian Cai <cai@redhat.com> wrote:
>
> On Wed, 2020-10-07 at 16:08 -0400, Qian Cai wrote:
> > Running some fuzzing by a unprivileged user on virtiofs could trigger the
> > warning below. The warning was introduced not long ago by the commit
> > c146024ec44c ("fuse: fix warning in tree_insert() and clean up writepage
> > insertion").
> >
> > From the logs, the last piece of the fuzzing code is:
> >
> > fgetxattr(fd=426, name=0x7f39a69af000, value=0x7f39a8abf000, size=1)
>
> I can still reproduce it on today's linux-next. Any idea on how to debug it
> further?

Can you please try the attached patch?

Thanks,
Miklos

[-- Attachment #2: fuse-launder-page-should-wait-for-page-writeback.patch --]
[-- Type: text/x-patch, Size: 515 bytes --]

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c03034e8c152..41b1e14f3820 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2281,6 +2281,9 @@ static int fuse_launder_page(struct page *page)
 	int err = 0;
 	if (clear_page_dirty_for_io(page)) {
 		struct inode *inode = page->mapping->host;
+
+		/* Serialize with pending writeback for the same page */
+		fuse_wait_on_page_writeback(inode, page->index);
 		err = fuse_writepage_locked(page);
 		if (!err)
 			fuse_wait_on_page_writeback(inode, page->index);