| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/28 00:05 | flow | patch-triage |
2mArgs:null Results: {
"EnableConfigs": [
"FUSE_FS",
"VIRTIO_FS"
],
"FocusSymbols": [
"fuse_do_setattr",
"fuse_open",
"fuse_dir_open",
"fuse_do_getattr",
"fuse_statfs",
"fuse_readlink_folio",
"virtio_fs_request_complete"
],
"KMSANReasoning": "The patch series modifies error code handling in FUSE and virtio-fs by translating -ENOENT responses to -ESTALE or -EOPENSTALE for operations referencing inodes by nodeid (e.g., FUSE_OPEN, FUSE_OPENDIR, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK, FUSE_STATFS) to enable VFS path lookup retries (retry_estale).\n\nThis change purely alters integer return values/errno codes in error paths. It does not introduce or modify any memory allocations, structure initializations, buffer copies to userspace, or data length calculations. There is no risk of uninitialized memory access or information disclosure that would require KMSAN detection. Any control flow or functional regression issues are covered by standard testing and KASAN builds.",
"NeedsKMSAN": false,
"Reasoning": "The patch updates error handling for live node IDs in FUSE and virtio-fs when the user/host server returns -ENOENT, translating it to -ESTALE or -EOPENSTALE to trigger VFS path lookup retries (LOOKUP_REVAL). These functional changes impact core file operations (open, getattr, setattr, readlink, statfs) in FUSE and virtio-fs.",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/28 00:05 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit b4cca34b6fee94863b1be203920938e1f4af9be4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Aug 28 00:05:30 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/fuse/dir.c b/fs/fuse/dir.c\nindex e49b4e874b15f..217a039990507 100644\n--- a/fs/fuse/dir.c\n+++ b/fs/fuse/dir.c\n@@ -1532,6 +1532,8 @@ static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode,\n \t\t\tif (stat)\n \t\t\t\tfuse_fillattr(idmap, inode, \u0026outarg.attr, stat);\n \t\t}\n+\t} else {\n+\t\terr = fuse_stale_inode_err(err);\n \t}\n \treturn err;\n }\n@@ -1848,6 +1850,7 @@ static int fuse_readlink_folio(struct inode *inode, struct folio *folio)\n \n \tfuse_invalidate_atime(inode);\n \n+\tres = fuse_stale_inode_err(res);\n \tif (res \u003c 0)\n \t\treturn res;\n \n@@ -1910,6 +1913,12 @@ static int fuse_dir_open(struct inode *inode, struct file *file)\n \t\treturn err;\n \n \terr = fuse_do_open(fm, get_node_id(inode), file, true);\n+\t/*\n+\t * As in fuse_open_common(): a path walk stands behind this open,\n+\t * so the refusal is EOPENSTALE for path_openat() to answer.\n+\t */\n+\tif (err == -ENOENT)\n+\t\terr = -EOPENSTALE;\n \tif (!err) {\n \t\tstruct fuse_file *ff = file-\u003eprivate_data;\n \n@@ -2249,6 +2258,7 @@ int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,\n \tif (err) {\n \t\tif (err == -EINTR)\n \t\t\tfuse_invalidate_attr(inode);\n+\t\terr = fuse_stale_inode_err(err);\n \t\tgoto error;\n \t}\n \ndiff --git a/fs/fuse/file.c b/fs/fuse/file.c\nindex 8d6135a6108a4..308b15c30f34d 100644\n--- a/fs/fuse/file.c\n+++ b/fs/fuse/file.c\n@@ -279,6 +279,17 @@ static int fuse_open(struct inode *inode, struct file *file)\n \t\tfuse_set_nowrite(inode);\n \n \terr = fuse_do_open(fm, get_node_id(inode), file, false);\n+\t/*\n+\t * This open reached the server through a path walk, so a refusal\n+\t * for the live nodeid is reported as EOPENSTALE rather than the\n+\t * ESTALE the nodeid-only requests say: path_openat() picks the\n+\t * cheapest retry for the walk in progress, ECHILD under LOOKUP_RCU\n+\t * and ESTALE otherwise. fuse_file_open() is left alone because\n+\t * fuse_priv_ioctl_prepare() reaches it to serve FS_IOC_GETFLAGS,\n+\t * with no open behind it to translate the internal errno.\n+\t */\n+\tif (err == -ENOENT)\n+\t\terr = -EOPENSTALE;\n \tif (!err) {\n \t\tff = file-\u003eprivate_data;\n \t\terr = fuse_finish_open(inode, file);\ndiff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h\nindex c8d4c5f3af7e8..e6b2597d6dd6f 100644\n--- a/fs/fuse/fuse_i.h\n+++ b/fs/fuse/fuse_i.h\n@@ -1250,6 +1250,25 @@ void fuse_inode_uncached_io_end(struct fuse_inode *fi);\n int fuse_file_io_open(struct file *file, struct inode *inode);\n void fuse_file_io_release(struct fuse_file *ff, struct inode *inode);\n \n+/*\n+ * Report a request refused for a live nodeid as stale.\n+ *\n+ * A request that names a nodeid and nothing else is only sent for an\n+ * inode the client has looked up and holds a reference to, and the\n+ * server owes the client that inode until it is sent FUSE_FORGET.\n+ * ENOENT from the server describes the inode itself rather than a name\n+ * that has gone away. Report the handle as stale, which the caller\n+ * answers by resolving the name again under LOOKUP_REVAL and acting on\n+ * whatever it refers to now. A name that really has gone fails that\n+ * second lookup and the caller still sees ENOENT.\n+ */\n+static inline int fuse_stale_inode_err(int err)\n+{\n+\tif (err == -ENOENT)\n+\t\treturn -ESTALE;\n+\treturn err;\n+}\n+\n /* file.c */\n struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid,\n \t\t\t\t unsigned int open_flags, bool isdir);\ndiff --git a/fs/fuse/inode.c b/fs/fuse/inode.c\nindex e9552be3637bc..cde0a53350897 100644\n--- a/fs/fuse/inode.c\n+++ b/fs/fuse/inode.c\n@@ -666,7 +666,7 @@ static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)\n \terr = fuse_simple_request(fm, \u0026args);\n \tif (!err)\n \t\tconvert_fuse_statfs(buf, \u0026outarg.st);\n-\treturn err;\n+\treturn fuse_stale_inode_err(err);\n }\n \n static struct fuse_sync_bucket *fuse_sync_bucket_alloc(void)\ndiff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c\nindex f15e516ebcb5c..7b03bf87c2ae8 100644\n--- a/fs/fuse/virtio_fs.c\n+++ b/fs/fuse/virtio_fs.c\n@@ -780,6 +780,66 @@ static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)\n \treturn true;\n }\n \n+/*\n+ * Report a request refused for a live nodeid as stale.\n+ *\n+ * These requests carry a nodeid and no name, so the client only sends them for\n+ * an inode it has already looked up and holds a reference to, and a server owes\n+ * the client that inode until it is sent FUSE_FORGET. A server answering with\n+ * ENOENT is describing a handle it was obliged to honour rather than a name\n+ * that has gone away, and the caller has no reason to doubt it.\n+ *\n+ * Saying the handle is stale is something the caller knows how to answer: it\n+ * repeats the lookup under LOOKUP_REVAL and acts on whatever the name refers to\n+ * now. A name that genuinely has gone fails the retried lookup, so a caller\n+ * still learns it is gone. retry_estale() is what does this, and fs/namei.c,\n+ * fs/open.c, fs/stat.c, fs/statfs.c, fs/utimes.c and fs/xattr.c all reach it,\n+ * which is what makes the conversion useful rather than a rename of the error.\n+ *\n+ * A request that names something which can itself be absent is left alone,\n+ * because ENOENT is then ambiguous and is frequently the answer the caller\n+ * asked for. FUSE_LOOKUP reports a missing name in a living directory and the\n+ * directory operations carry a parent nodeid beside one, so neither can be\n+ * read as a statement about the inode. The extended attribute requests belong\n+ * with them: they carry an attribute name, and while a server should report a\n+ * missing attribute as ENODATA, one that answers ENOENT instead would have a\n+ * correct reply turned into a retry that cannot succeed.\n+ *\n+ * Requests against an already open descriptor are also left alone, since there\n+ * is no equivalent retry to reach and converting the error would rename a\n+ * failure rather than repair it, and FUSE_IOCTL and FUSE_POLL hand the\n+ * server's errno to userspace verbatim.\n+ */\n+static void virtio_fs_fixup_stale_error(struct fuse_req *req)\n+{\n+\tif (req-\u003eout.h.error != -ENOENT)\n+\t\treturn;\n+\n+\tswitch (req-\u003ein.h.opcode) {\n+\tcase FUSE_OPEN:\n+\tcase FUSE_OPENDIR:\n+\t\t/*\n+\t\t * An open says EOPENSTALE, and path_openat() decides what the\n+\t\t * walk in progress should make of it: ECHILD under LOOKUP_RCU\n+\t\t * so it drops to REF-walk, ESTALE otherwise so the name is\n+\t\t * resolved again under LOOKUP_REVAL. Naming ESTALE here would\n+\t\t * take the second in both cases and skip a cheaper retry.\n+\t\t */\n+\t\treq-\u003eout.h.error = -EOPENSTALE;\n+\t\tbreak;\n+\tcase FUSE_GETATTR:\n+\tcase FUSE_SETATTR:\n+\tcase FUSE_READLINK:\n+\tcase FUSE_STATFS:\n+\t\t/*\n+\t\t * Nothing translates EOPENSTALE outside the open path, so\n+\t\t * these say ESTALE directly, which retry_estale() answers.\n+\t\t */\n+\t\treq-\u003eout.h.error = -ESTALE;\n+\t\tbreak;\n+\t}\n+}\n+\n /* Work function for request completion */\n static void virtio_fs_request_complete(struct fuse_req *req,\n \t\t\t\t struct virtio_fs_vq *fsvq)\n@@ -810,6 +870,8 @@ static void virtio_fs_request_complete(struct fuse_req *req,\n \n \tclear_bit(FR_SENT, \u0026req-\u003eflags);\n \n+\tvirtio_fs_fixup_stale_error(req);\n+\n \tfuse_request_end(req);\n \tspin_lock(\u0026fsvq-\u003elock);\n \tdec_in_flight_req(fsvq);\ndiff --git a/tools/testing/selftests/filesystems/fuse/.gitignore b/tools/testing/selftests/filesystems/fuse/.gitignore\nindex fb51603fe4198..9cb3048128d5b 100644\n--- a/tools/testing/selftests/filesystems/fuse/.gitignore\n+++ b/tools/testing/selftests/filesystems/fuse/.gitignore\n@@ -1,4 +1,6 @@\n # SPDX-License-Identifier: GPL-2.0-only\n+fuse_acl_cache_test\n fuse_mnt\n+fuse_estale_test\n fusectl_test\n write_extend_eof_test\ndiff --git a/tools/testing/selftests/filesystems/fuse/Makefile b/tools/testing/selftests/filesystems/fuse/Makefile\nindex 95a1ee947ca76..f564cb37b3a5b 100644\n--- a/tools/testing/selftests/filesystems/fuse/Makefile\n+++ b/tools/testing/selftests/filesystems/fuse/Makefile\n@@ -6,11 +6,12 @@ TEST_GEN_PROGS := fusectl_test\n TEST_GEN_PROGS += write_extend_eof_test\n TEST_GEN_FILES := fuse_mnt\n \n-# fuse_acl_cache_test requires libfuse3; add it only when the library is present.\n-ACL_CFLAGS := $(shell pkg-config fuse3 --cflags 2\u003e/dev/null)\n-ACL_LDLIBS := $(shell pkg-config fuse3 --libs 2\u003e/dev/null)\n-ifneq ($(ACL_CFLAGS),)\n+# These tests require libfuse3; add them only when the library is present.\n+FUSE3_CFLAGS := $(shell pkg-config fuse3 --cflags 2\u003e/dev/null)\n+FUSE3_LDLIBS := $(shell pkg-config fuse3 --libs 2\u003e/dev/null)\n+ifneq ($(FUSE3_CFLAGS),)\n TEST_GEN_PROGS += fuse_acl_cache_test\n+TEST_GEN_PROGS += fuse_estale_test\n endif\n \n include ../../lib.mk\n@@ -30,5 +31,8 @@ endif\n $(OUTPUT)/fuse_mnt: CFLAGS += $(VAR_CFLAGS)\n $(OUTPUT)/fuse_mnt: LDLIBS += $(VAR_LDLIBS)\n \n-$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(ACL_CFLAGS)\n-$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(ACL_LDLIBS)\n+$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(FUSE3_CFLAGS)\n+$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(FUSE3_LDLIBS)\n+\n+$(OUTPUT)/fuse_estale_test: CFLAGS += $(FUSE3_CFLAGS)\n+$(OUTPUT)/fuse_estale_test: LDLIBS += $(FUSE3_LDLIBS)\ndiff --git a/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c\nnew file mode 100644\nindex 0000000000000..82b842d3a5f7b\n--- /dev/null\n+++ b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c\n@@ -0,0 +1,450 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * Test: a request refused for an inode the client still holds a reference to\n+ *\n+ * FUSE_OPEN, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and FUSE_STATFS carry a\n+ * nodeid rather than a path. The client only sends them for an inode it has\n+ * already looked up and holds a reference to, and a server owes the client that\n+ * inode until it is sent FUSE_FORGET. A server that lets the inode go early,\n+ * as one backing a shared directory does when the name is renamed over, answers\n+ * with ENOENT.\n+ *\n+ * On an unfixed kernel that ENOENT is passed out unchanged. The path walk has\n+ * no reason to doubt it and the caller is told a file is missing when it never\n+ * stopped existing. Callers that read a missing file as an empty one act on\n+ * the emptiness.\n+ *\n+ * Fixed (fs/fuse/file.c and fs/fuse/dir.c): ENOENT becomes ESTALE, which\n+ * describes the handle rather than the name. filename_lookup() and\n+ * do_filp_open() already retry with LOOKUP_REVAL on ESTALE, so the name is\n+ * resolved again and the inode it refers to now is used. A name that has\n+ * genuinely gone away fails the retried lookup, so ENOENT still reaches a\n+ * caller that deserves it.\n+ *\n+ * Only requests reachable through a path walk are covered, because the retry\n+ * is what makes ESTALE useful and the walk is what performs it. An operation\n+ * on a descriptor already open has no equivalent recovery.\n+ *\n+ * Test outline:\n+ * 1. Mount a minimal FUSE fs holding one file.\n+ * 2. The server refuses the first request of the kind under test and allows\n+ * every one after it, standing in for a server that released the inode and\n+ * has since resolved the name again.\n+ * 3. openat() the file.\n+ * Buggy: ENOENT reaches the caller, one open was asked for. FAIL.\n+ * Fixed: the walk retries, the second open is allowed, the descriptor is\n+ * returned, two opens were asked for. PASS.\n+ * 4. stat(), chmod(), readlink() and statfs() by name, which are the same\n+ * recovery through FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and\n+ * FUSE_STATFS. Each is reached through a path walk, which is what makes\n+ * the retry available.\n+ * 5. Open a name the server does not have at all.\n+ * Both: ENOENT, because the lookup fails rather than the open, and a\n+ * file that is absent must still look absent.\n+ */\n+\n+#define _GNU_SOURCE\n+#define FUSE_USE_VERSION 34\n+\n+#include \u003cerrno.h\u003e\n+#include \u003cfcntl.h\u003e\n+#include \u003cfuse_lowlevel.h\u003e\n+#include \u003clinux/limits.h\u003e\n+#include \u003cpthread.h\u003e\n+#include \u003cstdio.h\u003e\n+#include \u003cstdlib.h\u003e\n+#include \u003cstdbool.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003csys/stat.h\u003e\n+#include \u003csys/statvfs.h\u003e\n+#include \u003csys/vfs.h\u003e\n+#include \u003cunistd.h\u003e\n+\n+#include \"../../kselftest_harness.h\"\n+\n+#define FILE_NAME\t\"held\"\n+#define LINK_NAME\t\"held-link\"\n+#define ABSENT_NAME\t\"no-such-file\"\n+#define FILE_INO\t2\n+#define LINK_INO\t3\n+#define CONTENTS\t\"present\\n\"\n+#define LINK_TARGET\tFILE_NAME\n+\n+/*\n+ * Which request the server refuses, and how many times. Shared with the\n+ * daemon thread; one test runs at a time, so plain ints.\n+ *\n+ * Every one of these names an inode by nodeid rather than by name, so a\n+ * refusal of any of them is describing a handle rather than a missing file.\n+ * FUSE_LOOKUP is deliberately absent: it carries a name, so its ENOENT is an\n+ * answer rather than a fault, and absent_name_still_reports_absent covers it.\n+ */\n+enum refuse_what {\n+\tREFUSE_NOTHING,\n+\tREFUSE_OPEN,\n+\tREFUSE_GETATTR,\n+\tREFUSE_SETATTR,\n+\tREFUSE_READLINK,\n+\tREFUSE_STATFS,\n+};\n+\n+static struct {\n+\tenum refuse_what what;\n+\tint refusals_left;\n+\tint opens_seen;\n+\tint getattrs_seen;\n+\tint setattrs_seen;\n+\tint readlinks_seen;\n+\tint statfss_seen;\n+} g_ds;\n+\n+/* True once, for the request under test, and then never again. */\n+static bool refuse_now(enum refuse_what what)\n+{\n+\tif (g_ds.what != what || g_ds.refusals_left \u003c= 0)\n+\t\treturn false;\n+\tg_ds.refusals_left--;\n+\treturn true;\n+}\n+\n+static void fill_attr(fuse_ino_t ino, struct stat *st)\n+{\n+\tmemset(st, 0, sizeof(*st));\n+\tst-\u003est_ino = ino;\n+\t/*\n+\t * Owned by whoever runs the test, so that chmod() is a request the\n+\t * kernel will carry through to the server rather than refuse itself.\n+\t */\n+\tst-\u003est_uid = getuid();\n+\tst-\u003est_gid = getgid();\n+\tif (ino == FUSE_ROOT_ID) {\n+\t\tst-\u003est_mode = S_IFDIR | 0755;\n+\t\tst-\u003est_nlink = 2;\n+\t} else if (ino == LINK_INO) {\n+\t\tst-\u003est_mode = S_IFLNK | 0777;\n+\t\tst-\u003est_nlink = 1;\n+\t\tst-\u003est_size = sizeof(LINK_TARGET) - 1;\n+\t} else {\n+\t\tst-\u003est_mode = S_IFREG | 0644;\n+\t\tst-\u003est_nlink = 1;\n+\t\tst-\u003est_size = sizeof(CONTENTS) - 1;\n+\t}\n+}\n+\n+static void t_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)\n+{\n+\tstruct fuse_entry_param e;\n+\tfuse_ino_t ino;\n+\n+\tif (parent != FUSE_ROOT_ID)\n+\t\tino = 0;\n+\telse if (!strcmp(name, FILE_NAME))\n+\t\tino = FILE_INO;\n+\telse if (!strcmp(name, LINK_NAME))\n+\t\tino = LINK_INO;\n+\telse\n+\t\tino = 0;\n+\n+\tif (!ino) {\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\n+\tmemset(\u0026e, 0, sizeof(e));\n+\te.ino = ino;\n+\te.attr_timeout = 0;\n+\te.entry_timeout = 0;\n+\tfill_attr(ino, \u0026e.attr);\n+\tfuse_reply_entry(req, \u0026e);\n+}\n+\n+static void t_getattr(fuse_req_t req, fuse_ino_t ino,\n+\t\t struct fuse_file_info *fi)\n+{\n+\tstruct stat st;\n+\n+\t(void)fi;\n+\t/* The root is left alone; refusing it would break the mount itself. */\n+\tif (ino == FILE_INO) {\n+\t\tg_ds.getattrs_seen++;\n+\t\tif (refuse_now(REFUSE_GETATTR)) {\n+\t\t\tfuse_reply_err(req, ENOENT);\n+\t\t\treturn;\n+\t\t}\n+\t}\n+\tfill_attr(ino, \u0026st);\n+\tfuse_reply_attr(req, \u0026st, 0);\n+}\n+\n+static void t_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)\n+{\n+\tif (ino != FILE_INO) {\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\n+\tg_ds.opens_seen++;\n+\tif (refuse_now(REFUSE_OPEN)) {\n+\t\t/*\n+\t\t * The inode is gone as far as this server is concerned, even\n+\t\t * though the client is holding a reference to it and asked by\n+\t\t * nodeid rather than by name.\n+\t\t */\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\tfuse_reply_open(req, fi);\n+}\n+\n+static void t_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t off,\n+\t\t struct fuse_file_info *fi)\n+{\n+\tsize_t len = sizeof(CONTENTS) - 1;\n+\n+\t(void)fi;\n+\tif (ino != FILE_INO) {\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\tif ((size_t)off \u003e= len) {\n+\t\tfuse_reply_buf(req, NULL, 0);\n+\t\treturn;\n+\t}\n+\tif (off + size \u003e len)\n+\t\tsize = len - off;\n+\tfuse_reply_buf(req, CONTENTS + off, size);\n+}\n+\n+static void t_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,\n+\t\t int to_set, struct fuse_file_info *fi)\n+{\n+\tstruct stat st;\n+\n+\t(void)attr;\n+\t(void)to_set;\n+\t(void)fi;\n+\tif (ino == FILE_INO) {\n+\t\tg_ds.setattrs_seen++;\n+\t\tif (refuse_now(REFUSE_SETATTR)) {\n+\t\t\tfuse_reply_err(req, ENOENT);\n+\t\t\treturn;\n+\t\t}\n+\t}\n+\tfill_attr(ino, \u0026st);\n+\tfuse_reply_attr(req, \u0026st, 0);\n+}\n+\n+static void t_readlink(fuse_req_t req, fuse_ino_t ino)\n+{\n+\tif (ino != LINK_INO) {\n+\t\tfuse_reply_err(req, EINVAL);\n+\t\treturn;\n+\t}\n+\n+\tg_ds.readlinks_seen++;\n+\tif (refuse_now(REFUSE_READLINK)) {\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\tfuse_reply_readlink(req, LINK_TARGET);\n+}\n+\n+static void t_statfs(fuse_req_t req, fuse_ino_t ino)\n+{\n+\tstruct statvfs sfs;\n+\n+\t(void)ino;\n+\tg_ds.statfss_seen++;\n+\tif (refuse_now(REFUSE_STATFS)) {\n+\t\tfuse_reply_err(req, ENOENT);\n+\t\treturn;\n+\t}\n+\n+\tmemset(\u0026sfs, 0, sizeof(sfs));\n+\tsfs.f_bsize = 512;\n+\tsfs.f_frsize = 512;\n+\tsfs.f_namemax = NAME_MAX;\n+\tfuse_reply_statfs(req, \u0026sfs);\n+}\n+\n+static const struct fuse_lowlevel_ops fs_ops = {\n+\t.lookup\t\t= t_lookup,\n+\t.getattr\t= t_getattr,\n+\t.setattr\t= t_setattr,\n+\t.readlink\t= t_readlink,\n+\t.statfs\t\t= t_statfs,\n+\t.open\t\t= t_open,\n+\t.read\t\t= t_read,\n+};\n+\n+static void *run_daemon(void *arg)\n+{\n+\tfuse_session_loop((struct fuse_session *)arg);\n+\treturn NULL;\n+}\n+\n+/* ---- kselftest harness --------------------------------------------------- */\n+\n+FIXTURE(open_estale) {\n+\tstruct fuse_session *se;\n+\tchar mountpoint[PATH_MAX];\n+\tchar file_path[PATH_MAX];\n+\tchar link_path[PATH_MAX];\n+\tchar absent_path[PATH_MAX];\n+\tpthread_t thread;\n+};\n+\n+FIXTURE_SETUP(open_estale)\n+{\n+\tchar *fuse_argv[] = { \"fuse_estale_test\", NULL };\n+\tstruct fuse_args args = FUSE_ARGS_INIT(1, fuse_argv);\n+\n+\tmemset(\u0026g_ds, 0, sizeof(g_ds));\n+\tg_ds.what = REFUSE_NOTHING;\n+\tg_ds.refusals_left = 1;\n+\n+\tstrcpy(self-\u003emountpoint, \"/tmp/open_estale_test_XXXXXX\");\n+\tif (!mkdtemp(self-\u003emountpoint))\n+\t\tSKIP(return, \"mkdtemp: %s\", strerror(errno));\n+\n+\tsnprintf(self-\u003efile_path, sizeof(self-\u003efile_path),\n+\t\t \"%s/\" FILE_NAME, self-\u003emountpoint);\n+\tsnprintf(self-\u003elink_path, sizeof(self-\u003elink_path),\n+\t\t \"%s/\" LINK_NAME, self-\u003emountpoint);\n+\tsnprintf(self-\u003eabsent_path, sizeof(self-\u003eabsent_path),\n+\t\t \"%s/\" ABSENT_NAME, self-\u003emountpoint);\n+\n+\tself-\u003ese = fuse_session_new(\u0026args, \u0026fs_ops, sizeof(fs_ops), NULL);\n+\tif (!self-\u003ese) {\n+\t\trmdir(self-\u003emountpoint);\n+\t\tSKIP(return, \"fuse_session_new failed\");\n+\t}\n+\n+\tif (fuse_session_mount(self-\u003ese, self-\u003emountpoint)) {\n+\t\tfuse_session_destroy(self-\u003ese);\n+\t\trmdir(self-\u003emountpoint);\n+\t\tSKIP(return, \"fuse_session_mount failed (no fusermount3 or no privileges)\");\n+\t}\n+\n+\tif (pthread_create(\u0026self-\u003ethread, NULL, run_daemon, self-\u003ese)) {\n+\t\tfuse_session_unmount(self-\u003ese);\n+\t\tfuse_session_destroy(self-\u003ese);\n+\t\trmdir(self-\u003emountpoint);\n+\t\tSKIP(return, \"pthread_create: %s\", strerror(errno));\n+\t}\n+\n+\tfuse_opt_free_args(\u0026args);\n+}\n+\n+FIXTURE_TEARDOWN(open_estale)\n+{\n+\tfuse_session_exit(self-\u003ese);\n+\tfuse_session_unmount(self-\u003ese);\n+\tpthread_join(self-\u003ethread, NULL);\n+\tfuse_session_destroy(self-\u003ese);\n+\trmdir(self-\u003emountpoint);\n+}\n+\n+TEST_F(open_estale, refused_open_is_retried)\n+{\n+\tint fd;\n+\n+\tg_ds.what = REFUSE_OPEN;\n+\n+\tfd = open(self-\u003efile_path, O_RDONLY);\n+\n+\t/*\n+\t * The refusal describes a handle the server should have honoured, so\n+\t * the walk is entitled to resolve the name again and open what it\n+\t * refers to now. Reporting the file missing instead ends the walk.\n+\t */\n+\tASSERT_GE(fd, 0) {\n+\t\tTH_LOG(\"open failed with %s after %d open request(s)\",\n+\t\t strerror(errno), g_ds.opens_seen);\n+\t}\n+\tEXPECT_EQ(2, g_ds.opens_seen);\n+\tclose(fd);\n+}\n+\n+TEST_F(open_estale, refused_getattr_on_path_is_retried)\n+{\n+\tstruct stat st;\n+\n+\tg_ds.what = REFUSE_GETATTR;\n+\n+\t/*\n+\t * Reached by name, so the walk can resolve it again and ask a second\n+\t * time, the same recovery the open gets.\n+\t */\n+\tASSERT_EQ(0, stat(self-\u003efile_path, \u0026st)) {\n+\t\tTH_LOG(\"stat failed with %s after %d getattr request(s)\",\n+\t\t strerror(errno), g_ds.getattrs_seen);\n+\t}\n+\tEXPECT_GT(g_ds.getattrs_seen, 1);\n+}\n+\n+TEST_F(open_estale, refused_setattr_on_path_is_retried)\n+{\n+\tg_ds.what = REFUSE_SETATTR;\n+\n+\t/*\n+\t * chmod() reaches the inode by name, so the same retry applies: the\n+\t * refusal describes a handle and the walk may resolve the name again.\n+\t */\n+\tASSERT_EQ(0, chmod(self-\u003efile_path, 0600)) {\n+\t\tTH_LOG(\"chmod failed with %s after %d setattr request(s)\",\n+\t\t strerror(errno), g_ds.setattrs_seen);\n+\t}\n+\tEXPECT_GT(g_ds.setattrs_seen, 1);\n+}\n+\n+TEST_F(open_estale, refused_readlink_on_path_is_retried)\n+{\n+\tchar buf[PATH_MAX];\n+\tssize_t n;\n+\n+\tg_ds.what = REFUSE_READLINK;\n+\n+\tn = readlink(self-\u003elink_path, buf, sizeof(buf) - 1);\n+\tASSERT_GE(n, 0) {\n+\t\tTH_LOG(\"readlink failed with %s after %d readlink request(s)\",\n+\t\t strerror(errno), g_ds.readlinks_seen);\n+\t}\n+\tbuf[n] = '\\0';\n+\tEXPECT_STREQ(LINK_TARGET, buf);\n+\tEXPECT_GT(g_ds.readlinks_seen, 1);\n+}\n+\n+TEST_F(open_estale, refused_statfs_on_path_is_retried)\n+{\n+\tstruct statfs sfs;\n+\n+\tg_ds.what = REFUSE_STATFS;\n+\n+\t/*\n+\t * statfs() describes the mount rather than the file, but it is still\n+\t * reached through a path walk, so a refusal that names a handle is\n+\t * retried the same way.\n+\t */\n+\tASSERT_EQ(0, statfs(self-\u003efile_path, \u0026sfs)) {\n+\t\tTH_LOG(\"statfs failed with %s after %d statfs request(s)\",\n+\t\t strerror(errno), g_ds.statfss_seen);\n+\t}\n+\tEXPECT_GT(g_ds.statfss_seen, 1);\n+}\n+\n+TEST_F(open_estale, absent_name_still_reports_absent)\n+{\n+\tint fd;\n+\n+\t/*\n+\t * Here it is the lookup that fails rather than the open, so nothing is\n+\t * being described as stale and the caller must still be told the name\n+\t * is not there.\n+\t */\n+\tfd = open(self-\u003eabsent_path, O_RDONLY);\n+\tASSERT_LT(fd, 0);\n+\tEXPECT_EQ(ENOENT, errno);\n+}\n+\n+TEST_HARNESS_MAIN\n"
} |
| 2/1 | 2026/08/28 00:05 | agent | patch-evaluator |
1mModel:core Args: null Results: {
"EnableConfigs": [
"FUSE_FS",
"VIRTIO_FS"
],
"FocusSymbols": [
"fuse_do_setattr",
"fuse_open",
"fuse_dir_open",
"fuse_do_getattr",
"fuse_statfs",
"fuse_readlink_folio",
"virtio_fs_request_complete"
],
"Reasoning": "The patch updates error handling for live node IDs in FUSE and virtio-fs when the user/host server returns -ENOENT, translating it to -ESTALE or -EOPENSTALE to trigger VFS path lookup retries (LOOKUP_REVAL). These functional changes impact core file operations (open, getattr, setattr, readlink, statfs) in FUSE and virtio-fs.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit b4cca34b6fee94863b1be203920938e1f4af9be4
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 28 00:05:30 2026 +0000
syz-cluster: applied patch under review
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index e49b4e874b15f..217a039990507 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1532,6 +1532,8 @@ static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode,
if (stat)
fuse_fillattr(idmap, inode, &outarg.attr, stat);
}
+ } else {
+ err = fuse_stale_inode_err(err);
}
return err;
}
@@ -1848,6 +1850,7 @@ static int fuse_readlink_folio(struct inode *inode, struct folio *folio)
fuse_invalidate_atime(inode);
+ res = fuse_stale_inode_err(res);
if (res < 0)
return res;
@@ -1910,6 +1913,12 @@ static int fuse_dir_open(struct inode *inode, struct file *file)
return err;
err = fuse_do_open(fm, get_node_id(inode), file, true);
+ /*
+ * As in fuse_open_common(): a path walk stands behind this open,
+ * so the refusal is EOPENSTALE for path_openat() to answer.
+ */
+ if (err == -ENOENT)
+ err = -EOPENSTALE;
if (!err) {
struct fuse_file *ff = file->private_data;
@@ -2249,6 +2258,7 @@ int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
if (err) {
if (err == -EINTR)
fuse_invalidate_attr(inode);
+ err = fuse_stale_inode_err(err);
goto error;
}
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 8d6135a6108a4..308b15c30f34d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -279,6 +279,17 @@ static int fuse_open(struct inode *inode, struct file *file)
fuse_set_nowrite(inode);
err = fuse_do_open(fm, get_node_id(inode), file, false);
+ /*
+ * This open reached the server through a path walk, so a refusal
+ * for the live nodeid is reported as EOPENSTALE rather than the
+ * ESTALE the nodeid-only requests say: path_openat() picks the
+ * cheapest retry for the walk in progress, ECHILD under LOOKUP_RCU
+ * and ESTALE otherwise. fuse_file_open() is left alone because
+ * fuse_priv_ioctl_prepare() reaches it to serve FS_IOC_GETFLAGS,
+ * with no open behind it to translate the internal errno.
+ */
+ if (err == -ENOENT)
+ err = -EOPENSTALE;
if (!err) {
ff = file->private_data;
err = fuse_finish_open(inode, file);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index c8d4c5f3af7e8..e6b2597d6dd6f 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -1250,6 +1250,25 @@ void fuse_inode_uncached_io_end(struct fuse_inode *fi);
int fuse_file_io_open(struct file *file, struct inode *inode);
void fuse_file_io_release(struct fuse_file *ff, struct inode *inode);
+/*
+ * Report a request refused for a live nodeid as stale.
+ *
+ * A request that names a nodeid and nothing else is only sent for an
+ * inode the client has looked up and holds a reference to, and the
+ * server owes the client that inode until it is sent FUSE_FORGET.
+ * ENOENT from the server describes the inode itself rather than a name
+ * that has gone away. Report the handle as stale, which the caller
+ * answers by resolving the name again under LOOKUP_REVAL and acting on
+ * whatever it refers to now. A name that really has gone fails that
+ * second lookup and the caller still sees ENOENT.
+ */
+static inline int fuse_stale_inode_err(int err)
+{
+ if (err == -ENOENT)
+ return -ESTALE;
+ return err;
+}
+
/* file.c */
struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid,
unsigned int open_flags, bool isdir);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index e9552be3637bc..cde0a53350897 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -666,7 +666,7 @@ static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)
err = fuse_simple_request(fm, &args);
if (!err)
convert_fuse_statfs(buf, &outarg.st);
- return err;
+ return fuse_stale_inode_err(err);
}
static struct fuse_sync_bucket *fuse_sync_bucket_alloc(void)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index f15e516ebcb5c..7b03bf87c2ae8 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -780,6 +780,66 @@ static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
return true;
}
+/*
+ * Report a request refused for a live nodeid as stale.
+ *
+ * These requests carry a nodeid and no name, so the client only sends them for
+ * an inode it has already looked up and holds a reference to, and a server owes
+ * the client that inode until it is sent FUSE_FORGET. A server answering with
+ * ENOENT is describing a handle it was obliged to honour rather than a name
+ * that has gone away, and the caller has no reason to doubt it.
+ *
+ * Saying the handle is stale is something the caller knows how to answer: it
+ * repeats the lookup under LOOKUP_REVAL and acts on whatever the name refers to
+ * now. A name that genuinely has gone fails the retried lookup, so a caller
+ * still learns it is gone. retry_estale() is what does this, and fs/namei.c,
+ * fs/open.c, fs/stat.c, fs/statfs.c, fs/utimes.c and fs/xattr.c all reach it,
+ * which is what makes the conversion useful rather than a rename of the error.
+ *
+ * A request that names something which can itself be absent is left alone,
+ * because ENOENT is then ambiguous and is frequently the answer the caller
+ * asked for. FUSE_LOOKUP reports a missing name in a living directory and the
+ * directory operations carry a parent nodeid beside one, so neither can be
+ * read as a statement about the inode. The extended attribute requests belong
+ * with them: they carry an attribute name, and while a server should report a
+ * missing attribute as ENODATA, one that answers ENOENT instead would have a
+ * correct reply turned into a retry that cannot succeed.
+ *
+ * Requests against an already open descriptor are also left alone, since there
+ * is no equivalent retry to reach and converting the error would rename a
+ * failure rather than repair it, and FUSE_IOCTL and FUSE_POLL hand the
+ * server's errno to userspace verbatim.
+ */
+static void virtio_fs_fixup_stale_error(struct fuse_req *req)
+{
+ if (req->out.h.error != -ENOENT)
+ return;
+
+ switch (req->in.h.opcode) {
+ case FUSE_OPEN:
+ case FUSE_OPENDIR:
+ /*
+ * An open says EOPENSTALE, and path_openat() decides what the
+ * walk in progress should make of it: ECHILD under LOOKUP_RCU
+ * so it drops to REF-walk, ESTALE otherwise so the name is
+ * resolved again under LOOKUP_REVAL. Naming ESTALE here would
+ * take the second in both cases and skip a cheaper retry.
+ */
+ req->out.h.error = -EOPENSTALE;
+ break;
+ case FUSE_GETATTR:
+ case FUSE_SETATTR:
+ case FUSE_READLINK:
+ case FUSE_STATFS:
+ /*
+ * Nothing translates EOPENSTALE outside the open path, so
+ * these say ESTALE directly, which retry_estale() answers.
+ */
+ req->out.h.error = -ESTALE;
+ break;
+ }
+}
+
/* Work function for request completion */
static void virtio_fs_request_complete(struct fuse_req *req,
struct virtio_fs_vq *fsvq)
@@ -810,6 +870,8 @@ static void virtio_fs_request_complete(struct fuse_req *req,
clear_bit(FR_SENT, &req->flags);
+ virtio_fs_fixup_stale_error(req);
+
fuse_request_end(req);
spin_lock(&fsvq->lock);
dec_in_flight_req(fsvq);
diff --git a/tools/testing/selftests/filesystems/fuse/.gitignore b/tools/testing/selftests/filesystems/fuse/.gitignore
index fb51603fe4198..9cb3048128d5b 100644
--- a/tools/testing/selftests/filesystems/fuse/.gitignore
+++ b/tools/testing/selftests/filesystems/fuse/.gitignore
@@ -1,4 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
+fuse_acl_cache_test
fuse_mnt
+fuse_estale_test
fusectl_test
write_extend_eof_test
diff --git a/tools/testing/selftests/filesystems/fuse/Makefile b/tools/testing/selftests/filesystems/fuse/Makefile
index 95a1ee947ca76..f564cb37b3a5b 100644
--- a/tools/testing/selftests/filesystems/fuse/Makefile
+++ b/tools/testing/selftests/filesystems/fuse/Makefile
@@ -6,11 +6,12 @@ TEST_GEN_PROGS := fusectl_test
TEST_GEN_PROGS += write_extend_eof_test
TEST_GEN_FILES := fuse_mnt
-# fuse_acl_cache_test requires libfuse3; add it only when the library is present.
-ACL_CFLAGS := $(shell pkg-config fuse3 --cflags 2>/dev/null)
-ACL_LDLIBS := $(shell pkg-config fuse3 --libs 2>/dev/null)
-ifneq ($(ACL_CFLAGS),)
+# These tests require libfuse3; add them only when the library is present.
+FUSE3_CFLAGS := $(shell pkg-config fuse3 --cflags 2>/dev/null)
+FUSE3_LDLIBS := $(shell pkg-config fuse3 --libs 2>/dev/null)
+ifneq ($(FUSE3_CFLAGS),)
TEST_GEN_PROGS += fuse_acl_cache_test
+TEST_GEN_PROGS += fuse_estale_test
endif
include ../../lib.mk
@@ -30,5 +31,8 @@ endif
$(OUTPUT)/fuse_mnt: CFLAGS += $(VAR_CFLAGS)
$(OUTPUT)/fuse_mnt: LDLIBS += $(VAR_LDLIBS)
-$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(ACL_CFLAGS)
-$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(ACL_LDLIBS)
+$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(FUSE3_CFLAGS)
+$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(FUSE3_LDLIBS)
+
+$(OUTPUT)/fuse_estale_test: CFLAGS += $(FUSE3_CFLAGS)
+$(OUTPUT)/fuse_estale_test: LDLIBS += $(FUSE3_LDLIBS)
diff --git a/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c
new file mode 100644
index 0000000000000..82b842d3a5f7b
--- /dev/null
+++ b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c
@@ -0,0 +1,450 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Test: a request refused for an inode the client still holds a reference to
+ *
+ * FUSE_OPEN, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and FUSE_STATFS carry a
+ * nodeid rather than a path. The client only sends them for an inode it has
+ * already looked up and holds a reference to, and a server owes the client that
+ * inode until it is sent FUSE_FORGET. A server that lets the inode go early,
+ * as one backing a shared directory does when the name is renamed over, answers
+ * with ENOENT.
+ *
+ * On an unfixed kernel that ENOENT is passed out unchanged. The path walk has
+ * no reason to doubt it and the caller is told a file is missing when it never
+ * stopped existing. Callers that read a missing file as an empty one act on
+ * the emptiness.
+ *
+ * Fixed (fs/fuse/file.c and fs/fuse/dir.c): ENOENT becomes ESTALE, which
+ * describes the handle rather than the name. filename_lookup() and
+ * do_filp_open() already retry with LOOKUP_REVAL on ESTALE, so the name is
+ * resolved again and the inode it refers to now is used. A name that has
+ * genuinely gone away fails the retried lookup, so ENOENT still reaches a
+ * caller that deserves it.
+ *
+ * Only requests reachable through a path walk are covered, because the retry
+ * is what makes ESTALE useful and the walk is what performs it. An operation
+ * on a descriptor already open has no equivalent recovery.
+ *
+ * Test outline:
+ * 1. Mount a minimal FUSE fs holding one file.
+ * 2. The server refuses the first request of the kind under test and allows
+ * every one after it, standing in for a server that released the inode and
+ * has since resolved the name again.
+ * 3. openat() the file.
+ * Buggy: ENOENT reaches the caller, one open was asked for. FAIL.
+ * Fixed: the walk retries, the second open is allowed, the descriptor is
+ * returned, two opens were asked for. PASS.
+ * 4. stat(), chmod(), readlink() and statfs() by name, which are the same
+ * recovery through FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and
+ * FUSE_STATFS. Each is reached through a path walk, which is what makes
+ * the retry available.
+ * 5. Open a name the server does not have at all.
+ * Both: ENOENT, because the lookup fails rather than the open, and a
+ * file that is absent must still look absent.
+ */
+
+#define _GNU_SOURCE
+#define FUSE_USE_VERSION 34
+
+#include <errno.h>
+#include <fcntl.h>
+#include <fuse_lowlevel.h>
+#include <linux/limits.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/vfs.h>
+#include <unistd.h>
+
+#include "../../kselftest_harness.h"
+
+#define FILE_NAME "held"
+#define LINK_NAME "held-link"
+#define ABSENT_NAME "no-such-file"
+#define FILE_INO 2
+#define LINK_INO 3
+#define CONTENTS "present\n"
+#define LINK_TARGET FILE_NAME
+
+/*
+ * Which request the server refuses, and how many times. Shared with the
+ * daemon thread; one test runs at a time, so plain ints.
+ *
+ * Every one of these names an inode by nodeid rather than by name, so a
+ * refusal of any of them is describing a handle rather than a missing file.
+ * FUSE_LOOKUP is deliberately absent: it carries a name, so its ENOENT is an
+ * answer rather than a fault, and absent_name_still_reports_absent covers it.
+ */
+enum refuse_what {
+ REFUSE_NOTHING,
+ REFUSE_OPEN,
+ REFUSE_GETATTR,
+ REFUSE_SETATTR,
+ REFUSE_READLINK,
+ REFUSE_STATFS,
+};
+
+static struct {
+ enum refuse_what what;
+ int refusals_left;
+ int opens_seen;
+ int getattrs_seen;
+ int setattrs_seen;
+ int readlinks_seen;
+ int statfss_seen;
+} g_ds;
+
+/* True once, for the request under test, and then never again. */
+static bool refuse_now(enum refuse_what what)
+{
+ if (g_ds.what != what || g_ds.refusals_left <= 0)
+ return false;
+ g_ds.refusals_left--;
+ return true;
+}
+
+static void fill_attr(fuse_ino_t ino, struct stat *st)
+{
+ memset(st, 0, sizeof(*st));
+ st->st_ino = ino;
+ /*
+ * Owned by whoever runs the test, so that chmod() is a request the
+ * kernel will carry through to the server rather than refuse itself.
+ */
+ st->st_uid = getuid();
+ st->st_gid = getgid();
+ if (ino == FUSE_ROOT_ID) {
+ st->st_mode = S_IFDIR | 0755;
+ st->st_nlink = 2;
+ } else if (ino == LINK_INO) {
+ st->st_mode = S_IFLNK | 0777;
+ st->st_nlink = 1;
+ st->st_size = sizeof(LINK_TARGET) - 1;
+ } else {
+ st->st_mode = S_IFREG | 0644;
+ st->st_nlink = 1;
+ st->st_size = sizeof(CONTENTS) - 1;
+ }
+}
+
+static void t_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
+{
+ struct fuse_entry_param e;
+ fuse_ino_t ino;
+
+ if (parent != FUSE_ROOT_ID)
+ ino = 0;
+ else if (!strcmp(name, FILE_NAME))
+ ino = FILE_INO;
+ else if (!strcmp(name, LINK_NAME))
+ ino = LINK_INO;
+ else
+ ino = 0;
+
+ if (!ino) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ memset(&e, 0, sizeof(e));
+ e.ino = ino;
+ e.attr_timeout = 0;
+ e.entry_timeout = 0;
+ fill_attr(ino, &e.attr);
+ fuse_reply_entry(req, &e);
+}
+
+static void t_getattr(fuse_req_t req, fuse_ino_t ino,
+ struct fuse_file_info *fi)
+{
+ struct stat st;
+
+ (void)fi;
+ /* The root is left alone; refusing it would break the mount itself. */
+ if (ino == FILE_INO) {
+ g_ds.getattrs_seen++;
+ if (refuse_now(REFUSE_GETATTR)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ }
+ fill_attr(ino, &st);
+ fuse_reply_attr(req, &st, 0);
+}
+
+static void t_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
+{
+ if (ino != FILE_INO) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ g_ds.opens_seen++;
+ if (refuse_now(REFUSE_OPEN)) {
+ /*
+ * The inode is gone as far as this server is concerned, even
+ * though the client is holding a reference to it and asked by
+ * nodeid rather than by name.
+ */
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ fuse_reply_open(req, fi);
+}
+
+static void t_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t off,
+ struct fuse_file_info *fi)
+{
+ size_t len = sizeof(CONTENTS) - 1;
+
+ (void)fi;
+ if (ino != FILE_INO) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ if ((size_t)off >= len) {
+ fuse_reply_buf(req, NULL, 0);
+ return;
+ }
+ if (off + size > len)
+ size = len - off;
+ fuse_reply_buf(req, CONTENTS + off, size);
+}
+
+static void t_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
+ int to_set, struct fuse_file_info *fi)
+{
+ struct stat st;
+
+ (void)attr;
+ (void)to_set;
+ (void)fi;
+ if (ino == FILE_INO) {
+ g_ds.setattrs_seen++;
+ if (refuse_now(REFUSE_SETATTR)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ }
+ fill_attr(ino, &st);
+ fuse_reply_attr(req, &st, 0);
+}
+
+static void t_readlink(fuse_req_t req, fuse_ino_t ino)
+{
+ if (ino != LINK_INO) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
+ g_ds.readlinks_seen++;
+ if (refuse_now(REFUSE_READLINK)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ fuse_reply_readlink(req, LINK_TARGET);
+}
+
+static void t_statfs(fuse_req_t req, fuse_ino_t ino)
+{
+ struct statvfs sfs;
+
+ (void)ino;
+ g_ds.statfss_seen++;
+ if (refuse_now(REFUSE_STATFS)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ memset(&sfs, 0, sizeof(sfs));
+ sfs.f_bsize = 512;
+ sfs.f_frsize = 512;
+ sfs.f_namemax = NAME_MAX;
+ fuse_reply_statfs(req, &sfs);
+}
+
+static const struct fuse_lowlevel_ops fs_ops = {
+ .lookup = t_lookup,
+ .getattr = t_getattr,
+ .setattr = t_setattr,
+ .readlink = t_readlink,
+ .statfs = t_statfs,
+ .open = t_open,
+ .read = t_read,
+};
+
+static void *run_daemon(void *arg)
+{
+ fuse_session_loop((struct fuse_session *)arg);
+ return NULL;
+}
+
+/* ---- kselftest harness --------------------------------------------------- */
+
+FIXTURE(open_estale) {
+ struct fuse_session *se;
+ char mountpoint[PATH_MAX];
+ char file_path[PATH_MAX];
+ char link_path[PATH_MAX];
+ char absent_path[PATH_MAX];
+ pthread_t thread;
+};
+
+FIXTURE_SETUP(open_estale)
+{
+ char *fuse_argv[] = { "fuse_estale_test", NULL };
+ struct fuse_args args = FUSE_ARGS_INIT(1, fuse_argv);
+
+ memset(&g_ds, 0, sizeof(g_ds));
+ g_ds.what = REFUSE_NOTHING;
+ g_ds.refusals_left = 1;
+
+ strcpy(self->mountpoint, "/tmp/open_estale_test_XXXXXX");
+ if (!mkdtemp(self->mountpoint))
+ SKIP(return, "mkdtemp: %s", strerror(errno));
+
+ snprintf(self->file_path, sizeof(self->file_path),
+ "%s/" FILE_NAME, self->mountpoint);
+ snprintf(self->link_path, sizeof(self->link_path),
+ "%s/" LINK_NAME, self->mountpoint);
+ snprintf(self->absent_path, sizeof(self->absent_path),
+ "%s/" ABSENT_NAME, self->mountpoint);
+
+ self->se = fuse_session_new(&args, &fs_ops, sizeof(fs_ops), NULL);
+ if (!self->se) {
+ rmdir(self->mountpoint);
+ SKIP(return, "fuse_session_new failed");
+ }
+
+ if (fuse_session_mount(self->se, self->mountpoint)) {
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+ SKIP(return, "fuse_session_mount failed (no fusermount3 or no privileges)");
+ }
+
+ if (pthread_create(&self->thread, NULL, run_daemon, self->se)) {
+ fuse_session_unmount(self->se);
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+ SKIP(return, "pthread_create: %s", strerror(errno));
+ }
+
+ fuse_opt_free_args(&args);
+}
+
+FIXTURE_TEARDOWN(open_estale)
+{
+ fuse_session_exit(self->se);
+ fuse_session_unmount(self->se);
+ pthread_join(self->thread, NULL);
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+}
+
+TEST_F(open_estale, refused_open_is_retried)
+{
+ int fd;
+
+ g_ds.what = REFUSE_OPEN;
+
+ fd = open(self->file_path, O_RDONLY);
+
+ /*
+ * The refusal describes a handle the server should have honoured, so
+ * the walk is entitled to resolve the name again and open what it
+ * refers to now. Reporting the file missing instead ends the walk.
+ */
+ ASSERT_GE(fd, 0) {
+ TH_LOG("open failed with %s after %d open request(s)",
+ strerror(errno), g_ds.opens_seen);
+ }
+ EXPECT_EQ(2, g_ds.opens_seen);
+ close(fd);
+}
+
+TEST_F(open_estale, refused_getattr_on_path_is_retried)
+{
+ struct stat st;
+
+ g_ds.what = REFUSE_GETATTR;
+
+ /*
+ * Reached by name, so the walk can resolve it again and ask a second
+ * time, the same recovery the open gets.
+ */
+ ASSERT_EQ(0, stat(self->file_path, &st)) {
+ TH_LOG("stat failed with %s after %d getattr request(s)",
+ strerror(errno), g_ds.getattrs_seen);
+ }
+ EXPECT_GT(g_ds.getattrs_seen, 1);
+}
+
+TEST_F(open_estale, refused_setattr_on_path_is_retried)
+{
+ g_ds.what = REFUSE_SETATTR;
+
+ /*
+ * chmod() reaches the inode by name, so the same retry applies: the
+ * refusal describes a handle and the walk may resolve the name again.
+ */
+ ASSERT_EQ(0, chmod(self->file_path, 0600)) {
+ TH_LOG("chmod failed with %s after %d setattr request(s)",
+ strerror(errno), g_ds.setattrs_seen);
+ }
+ EXPECT_GT(g_ds.setattrs_seen, 1);
+}
+
+TEST_F(open_estale, refused_readlink_on_path_is_retried)
+{
+ char buf[PATH_MAX];
+ ssize_t n;
+
+ g_ds.what = REFUSE_READLINK;
+
+ n = readlink(self->link_path, buf, sizeof(buf) - 1);
+ ASSERT_GE(n, 0) {
+ TH_LOG("readlink failed with %s after %d readlink request(s)",
+ strerror(errno), g_ds.readlinks_seen);
+ }
+ buf[n] = '\0';
+ EXPECT_STREQ(LINK_TARGET, buf);
+ EXPECT_GT(g_ds.readlinks_seen, 1);
+}
+
+TEST_F(open_estale, refused_statfs_on_path_is_retried)
+{
+ struct statfs sfs;
+
+ g_ds.what = REFUSE_STATFS;
+
+ /*
+ * statfs() describes the mount rather than the file, but it is still
+ * reached through a path walk, so a refusal that names a handle is
+ * retried the same way.
+ */
+ ASSERT_EQ(0, statfs(self->file_path, &sfs)) {
+ TH_LOG("statfs failed with %s after %d statfs request(s)",
+ strerror(errno), g_ds.statfss_seen);
+ }
+ EXPECT_GT(g_ds.statfss_seen, 1);
+}
+
+TEST_F(open_estale, absent_name_still_reports_absent)
+{
+ int fd;
+
+ /*
+ * Here it is the lookup that fails rather than the open, so nothing is
+ * being described as stale and the caller must still be told the name
+ * is not there.
+ */
+ fd = open(self->absent_path, O_RDONLY);
+ ASSERT_LT(fd, 0);
+ EXPECT_EQ(ENOENT, errno);
+}
+
+TEST_HARNESS_MAIN
|
| 3/2 | 2026/08/28 00:05 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10132 output: 27 thoughts: 147 Thoughts: **Analyzing this Patch Series for Fuzzing Potential** Okay, so the task at hand is to determine if this Linux kernel patch series merits fuzzing attention. And if it does, the next step is to pinpoint the crucial `FocusSymbols` and `EnableConfigs` that will make fuzzing most effective. Let's dig in. The initial glance at the patch reveals its scope: it's playing in the `fs/fuse` directory, touching `dir.c`, `file.c`, `fuse_i.h`, `inode.c`, and `virtio_fs.c`, plus a chunk of the self-tests in `tools/testing/selftests/filesystems/fuse/...`. This tells me we're looking at potentially sensitive filesystem interactions within the FUSE (Filesystem in Userspace) context, which is definitely something I want to take a closer look at. Now, it's time to get down to brass tacks: I'll start by examining the relevant `Kconfig` files. That's the go-to for understanding the dependencies and configuration options at play. My immediate thought is to use my grepper or perhaps a quick `read-file` to get a handle on what's available and conditional on this section of code. The aim is to understand what build flags and configuration options are relevant and how they might influence the attack surface. |
| 4/2 | 2026/08/28 00:05 | tool | grepper |
0mArgs:{
"Expression": "FUSE_FS",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/fuse/Kconfig:2:config FUSE_FS\nfs/fuse/Kconfig-3-\ttristate \"FUSE (Filesystem in Userspace) support\"\n--\nfs/fuse/Kconfig=22=config CUSE\nfs/fuse/Kconfig-23-\ttristate \"Character device in Userspace support\"\nfs/fuse/Kconfig:24:\tdepends on FUSE_FS\nfs/fuse/Kconfig-25-\thelp\n--\nfs/fuse/Kconfig=32=config VIRTIO_FS\nfs/fuse/Kconfig-33-\ttristate \"Virtio Filesystem\"\nfs/fuse/Kconfig:34:\tdepends on FUSE_FS\nfs/fuse/Kconfig-35-\tselect VIRTIO\n--\nfs/fuse/Kconfig=57=config FUSE_PASSTHROUGH\n--\nfs/fuse/Kconfig-59-\tdefault y\nfs/fuse/Kconfig:60:\tdepends on FUSE_FS\nfs/fuse/Kconfig-61-\tselect FS_STACK\n--\nfs/fuse/Kconfig=68=config FUSE_IO_URING\n--\nfs/fuse/Kconfig-70-\tdefault y\nfs/fuse/Kconfig:71:\tdepends on FUSE_FS\nfs/fuse/Kconfig-72-\tdepends on IO_URING\n--\nfs/fuse/Makefile=7=ccflags-y = -I$(src)\nfs/fuse/Makefile-8-\nfs/fuse/Makefile:9:obj-$(CONFIG_FUSE_FS) += fuse.o\nfs/fuse/Makefile-10-obj-$(CONFIG_CUSE) += cuse.o\n--\nfs/fuse/dir.c=1946=static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,\n--\nfs/fuse/dir.c-1959-\tinode_lock(inode);\nfs/fuse/dir.c:1960:\terr = fuse_fsync_common(file, start, end, datasync, FUSE_FSYNCDIR);\nfs/fuse/dir.c-1961-\tif (err == -ENOSYS) {\n--\nfs/fuse/file.c=531=int fuse_fsync_common(struct file *file, loff_t start, loff_t end,\n--\nfs/fuse/file.c-541-\tinarg.fh = ff-\u003efh;\nfs/fuse/file.c:542:\tinarg.fsync_flags = datasync ? FUSE_FSYNC_FDATASYNC : 0;\nfs/fuse/file.c-543-\targs.opcode = opcode;\n--\nfs/fuse/file.c=551=static int fuse_fsync(struct file *file, loff_t start, loff_t end,\n--\nfs/fuse/file.c-589-\nfs/fuse/file.c:590:\terr = fuse_fsync_common(file, start, end, datasync, FUSE_FSYNC);\nfs/fuse/file.c-591-\tif (err == -ENOSYS) {\n--\nfs/fuse/fuse_trace.h-27-\tEM( FUSE_RELEASE,\t\t\"FUSE_RELEASE\")\t\t\\\nfs/fuse/fuse_trace.h:28:\tEM( FUSE_FSYNC,\t\t\t\"FUSE_FSYNC\")\t\t\\\nfs/fuse/fuse_trace.h-29-\tEM( FUSE_SETXATTR,\t\t\"FUSE_SETXATTR\")\t\\\n--\nfs/fuse/fuse_trace.h-37-\tEM( FUSE_RELEASEDIR,\t\t\"FUSE_RELEASEDIR\")\t\\\nfs/fuse/fuse_trace.h:38:\tEM( FUSE_FSYNCDIR,\t\t\"FUSE_FSYNCDIR\")\t\\\nfs/fuse/fuse_trace.h-39-\tEM( FUSE_GETLK,\t\t\t\"FUSE_GETLK\")\t\t\\\n"
} |
| 5/2 | 2026/08/28 00:05 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11616 output: 32 thoughts: 17 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Diving into the FUSE Kernel Module Configuration** Right, time to get my hands dirty. Let's see what's actually going on with the FUSE kernel module build and configuration. My initial step is always to go straight to the source. I'm thinking I'll start by checking the `fs/fuse/Kconfig` file. That's where all the build-time configuration options for FUSE should be defined – things like whether it's built-in, a module, features to enable or disable, and so on. Understanding the Kconfig options is fundamental to configuring the FUSE module appropriately for a specific environment or use case. I need to figure out which options are available and what they're set to. Then, with that understanding, I'll move on to `fs/fuse/Makefile`. The Makefile will show me the build process itself: the dependencies, the source files included, compiler flags, and the overall structure of how FUSE is compiled and linked into the kernel. By examining both of these files, I should get a clear picture of how FUSE is intended to be used, its compilation process, and the flexibility offered to an end-user during the build process. |
| 6/2 | 2026/08/28 00:05 | tool | read-file |
0mArgs:{
"File": "fs/fuse/Kconfig",
"FirstLine": 1,
"LineCount": 75
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig FUSE_FS\n 3:\t\ttristate \"FUSE (Filesystem in Userspace) support\"\n 4:\t\tselect FS_POSIX_ACL\n 5:\t\tselect FS_IOMAP\n 6:\t\thelp\n 7:\t\t With FUSE it is possible to implement a fully functional filesystem\n 8:\t\t in a userspace program.\n 9:\t\n 10:\t\t There's also a companion library: libfuse2. This library is available\n 11:\t\t from the FUSE homepage:\n 12:\t\t \u003chttps://github.com/libfuse/\u003e\n 13:\t\t although chances are your distribution already has that library\n 14:\t\t installed if you've installed the \"fuse\" package itself.\n 15:\t\n 16:\t\t See \u003cfile:Documentation/filesystems/fuse/fuse.rst\u003e for more information.\n 17:\t\t See \u003cfile:Documentation/Changes\u003e for needed library/utility version.\n 18:\t\n 19:\t\t If you want to develop a userspace FS, or if you want to use\n 20:\t\t a filesystem based on FUSE, answer Y or M.\n 21:\t\n 22:\tconfig CUSE\n 23:\t\ttristate \"Character device in Userspace support\"\n 24:\t\tdepends on FUSE_FS\n 25:\t\thelp\n 26:\t\t This FUSE extension allows character devices to be\n 27:\t\t implemented in userspace.\n 28:\t\n 29:\t\t If you want to develop or use a userspace character device\n 30:\t\t based on CUSE, answer Y or M.\n 31:\t\n 32:\tconfig VIRTIO_FS\n 33:\t\ttristate \"Virtio Filesystem\"\n 34:\t\tdepends on FUSE_FS\n 35:\t\tselect VIRTIO\n 36:\t\thelp\n 37:\t\t The Virtio Filesystem allows guests to mount file systems from the\n 38:\t\t host.\n 39:\t\n 40:\t\t If you want to share files between guests or with the host, answer Y\n 41:\t\t or M.\n 42:\t\n 43:\tconfig FUSE_DAX\n 44:\t\tbool \"Virtio Filesystem Direct Host Memory Access support\"\n 45:\t\tdefault y\n 46:\t\tselect INTERVAL_TREE\n 47:\t\tdepends on VIRTIO_FS\n 48:\t\tdepends on FS_DAX\n 49:\t\tdepends on DAX\n 50:\t\thelp\n 51:\t\t This allows bypassing guest page cache and allows mapping host page\n 52:\t\t cache directly in guest address space.\n 53:\t\n 54:\t\t If you want to allow mounting a Virtio Filesystem with the \"dax\"\n 55:\t\t option, answer Y.\n 56:\t\n 57:\tconfig FUSE_PASSTHROUGH\n 58:\t\tbool \"FUSE passthrough operations support\"\n 59:\t\tdefault y\n 60:\t\tdepends on FUSE_FS\n 61:\t\tselect FS_STACK\n 62:\t\thelp\n 63:\t\t This allows bypassing FUSE server by mapping specific FUSE operations\n 64:\t\t to be performed directly on a backing file.\n 65:\t\n 66:\t\t If you want to allow passthrough operations, answer Y.\n 67:\t\n 68:\tconfig FUSE_IO_URING\n 69:\t\tbool \"FUSE communication over io-uring\"\n 70:\t\tdefault y\n 71:\t\tdepends on FUSE_FS\n 72:\t\tdepends on IO_URING\n 73:\t\thelp\n 74:\t\t This allows sending FUSE requests over the io-uring interface and\n 75:\t also adds request core affinity.\n"
} |
| 7/2 | 2026/08/28 00:05 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12911 output: 31 thoughts: 19 Thoughts: Here's my take on those thoughts: **Analyzing the Fuse Makefile for Build Configurations** Alright, let's dive into the `fs/fuse/Makefile`. I need to understand the build process for the FUSE module. I'm specifically interested in how the different configuration options affect which files are compiled and linked. I want to see which source files get included or excluded based on different kernel configs. This level of granular understanding is critical for debugging and optimization. A thorough review of the Makefile is the best way to get that bird's-eye view of the build process. |
| 8/2 | 2026/08/28 00:05 | tool | read-file |
0mArgs:{
"File": "fs/fuse/Makefile",
"FirstLine": 1,
"LineCount": 25
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t#\n 3:\t# Makefile for the FUSE filesystem.\n 4:\t#\n 5:\t\n 6:\t# Needed for trace events\n 7:\tccflags-y = -I$(src)\n 8:\t\n 9:\tobj-$(CONFIG_FUSE_FS) += fuse.o\n 10:\tobj-$(CONFIG_CUSE) += cuse.o\n 11:\tobj-$(CONFIG_VIRTIO_FS) += virtiofs.o\n 12:\t\n 13:\tfuse-y := trace.o\t# put trace.o first so we see ftrace errors sooner\n 14:\tfuse-y += dev.o dir.o file.o inode.o control.o xattr.o acl.o readdir.o ioctl.o req_timeout.o req.o\n 15:\tfuse-y += poll.o notify.o\n 16:\tfuse-y += iomode.o\n 17:\tfuse-$(CONFIG_FUSE_DAX) += dax.o\n 18:\tfuse-$(CONFIG_FUSE_PASSTHROUGH) += passthrough.o backing.o\n 19:\tfuse-$(CONFIG_SYSCTL) += sysctl.o\n 20:\tfuse-$(CONFIG_FUSE_IO_URING) += dev_uring.o\n 21:\t\n 22:\tvirtiofs-y := virtio_fs.o\n"
} |
| 9/2 | 2026/08/28 00:05 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13464 output: 29 thoughts: 707 Thoughts: **Analyzing the FUSE Patch: A Fuzzing Opportunity** Okay, let's break down this patch. My initial thought is that it's focusing on enhancing FUSE and virtio-fs error handling, specifically concerning ENOENT errors when dealing with live node IDs. It seems like the core issue is how we're handling stale inodes, aiming to provide more robust error signaling. My key concern is how this error handling percolates up through the VFS. This patch is modifying several key areas: `fs/fuse/dir.c`, `fs/fuse/file.c`, `fs/fuse/fuse_i.h`, `fs/fuse/inode.c`, and `fs/fuse/virtio_fs.c`. It looks like ENOENT is being converted to ESTALE or EOPENSTALE in several contexts: `fuse_do_getattr`, `fuse_readlink_folio`, `fuse_dir_open`, `fuse_do_setattr`, `fuse_open`, and `fuse_statfs`, with specific handling in `virtio_fs_request_complete`. The addition of new tests is promising, but I need to understand the coverage and focus. The significant changes are: * In `fs/fuse/dir.c`, `fuse_do_getattr`, `fuse_readlink_folio`, `fuse_dir_open`, and `fuse_do_setattr`. * In `fs/fuse/file.c`, `fuse_open`. * A new helper `fuse_stale_inode_err()` in `fs/fuse/fuse_i.h`. * In `fs/fuse/inode.c`, `fuse_statfs`. * In `fs/fuse/virtio_fs.c`, `virtio_fs_request_complete`. Now, does this merit fuzzing? Absolutely, yes! The FUSE error handling and return codes (ESTALE, EOPENSTALE, and the ENOENT retry logic) directly impact VFS path resolution and file operations across the board. Operations like open, getattr, setattr, statfs, and readlink will be directly affected by these changes when interacting with userspace FUSE servers or virtio-fs. This is accessible from pretty standard virtualized environments, such as QEMU or GCE. I need to confirm the scope of this. I'm focusing on those modifications: `fuse_do_setattr`, `fuse_do_getattr`, `fuse_dir_open`, `fuse_open`, `fuse_readlink_folio`, `fuse_statfs`, and `virtio_fs_request_complete`. The non-static nature of `fuse_do_setattr` is worth a deeper dive. I want to check its declarations, callers, and overall usage across FUSE files. Let's analyze the callers of the `static` functions as well. I need to understand the call chains and how these error codes are propagated. Given that these functions are deeply involved with file operations, they represent fertile ground for fuzzing to uncover potential issues, especially race conditions or incorrect error propagation. So, let's map out the functions. I'll need to check the exact declarations, where they're defined, and the callers of each. A thorough analysis here will reveal potential entry points for fuzzing. |
| 10/2 | 2026/08/28 00:06 | tool | grepper |
0mArgs:{
"Expression": "fuse_do_setattr",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/dir.c=2119=int fuse_flush_times(struct inode *inode, struct fuse_file *ff)\n--\nfs/fuse/dir.c-2153- */\nfs/fuse/dir.c:2154:int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,\nfs/fuse/dir.c-2155-\t\t struct iattr *attr, struct file *file)\n--\nfs/fuse/dir.c=2336=static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,\n--\nfs/fuse/dir.c-2382-\nfs/fuse/dir.c:2383:\tret = fuse_do_setattr(idmap, entry, attr, file);\nfs/fuse/dir.c-2384-\tif (!ret) {\n--\nfs/fuse/file.c=2712=static void fuse_do_truncate(struct file *file)\n--\nfs/fuse/file.c-2722-\nfs/fuse/file.c:2723:\tfuse_do_setattr(file_mnt_idmap(file), file_dentry(file), \u0026attr, file);\nfs/fuse/file.c-2724-}\n--\nfs/fuse/fuse_i.h=1190=int fuse_write_inode(struct inode *inode, struct writeback_control *wbc);\nfs/fuse/fuse_i.h-1191-\nfs/fuse/fuse_i.h:1192:int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,\nfs/fuse/fuse_i.h-1193-\t\t struct iattr *attr, struct file *file);\n"
} |
| 11/2 | 2026/08/28 00:06 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 15373 output: 54 thoughts: 74 Thoughts: Okay, here's my take on those functions. **Initial Considerations for FUSE Kernel Module Review** Alright, before I dive in too deep, let's establish our immediate priorities. My mind is already running through a quick checklist of critical FUSE functions that demand my attention. Specifically, I'm thinking about `fuse_open`, `fuse_dir_open`, `fuse_statfs`, `fuse_getattr`, and `fuse_setattr`. These are the core building blocks for file access, directory traversal, filesystem statistics, attribute retrieval, and attribute modification, respectively. Then there's the folio-specific handling, which also needs a look at `fuse_readlink_folio`, and `fuse_symlink_read_folio`, and finally let's throw in `virtio_fs_request_complete`, to ensure a complete picture. With those in mind, I need to know the exact definitions of these in the FUSE kernel module. Looks like the logical first step is to immediately pull up `fs/fuse/` and begin the code review. That'll be a good starting point. |
| 12/2 | 2026/08/28 00:06 | tool | grepper |
0mArgs:{
"Expression": "^(static )?(int|void) fuse_(open|dir_open|statfs|getattr|setattr|symlink_read_folio)",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/dir.c=1866=static const char *fuse_get_link(struct dentry *dentry, struct inode *inode,\n--\nfs/fuse/dir.c-1902-\nfs/fuse/dir.c:1903:static int fuse_dir_open(struct inode *inode, struct file *file)\nfs/fuse/dir.c-1904-{\n--\nfs/fuse/dir.c=2092=void fuse_release_nowrite(struct inode *inode)\n--\nfs/fuse/dir.c-2100-\nfs/fuse/dir.c:2101:static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_args *args,\nfs/fuse/dir.c-2102-\t\t\t struct inode *inode,\n--\nfs/fuse/dir.c=2154=int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,\n--\nfs/fuse/dir.c-2335-\nfs/fuse/dir.c:2336:static int fuse_setattr(struct mnt_idmap *idmap, struct dentry *entry,\nfs/fuse/dir.c-2337-\t\t\tstruct iattr *attr)\n--\nfs/fuse/dir.c-2398-\nfs/fuse/dir.c:2399:static int fuse_getattr(struct mnt_idmap *idmap,\nfs/fuse/dir.c-2400-\t\t\tconst struct path *path, struct kstat *stat,\n--\nfs/fuse/dir.c=2483=void fuse_init_dir(struct inode *inode)\n--\nfs/fuse/dir.c-2496-\nfs/fuse/dir.c:2497:static int fuse_symlink_read_folio(struct file *null, struct folio *folio)\nfs/fuse/dir.c-2498-{\n--\nfs/fuse/file.c=237=static void fuse_truncate_update_attr(struct inode *inode, struct file *file)\n--\nfs/fuse/file.c-249-\nfs/fuse/file.c:250:static int fuse_open(struct inode *inode, struct file *file)\nfs/fuse/file.c-251-{\n--\nfs/fuse/inode.c=632=static void convert_fuse_statfs(struct kstatfs *stbuf, struct fuse_kstatfs *attr)\n--\nfs/fuse/inode.c-645-\nfs/fuse/inode.c:646:static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)\nfs/fuse/inode.c-647-{\n"
} |
| 13/2 | 2026/08/28 00:06 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 16423 output: 31 thoughts: 22 Thoughts: Here's a summary of my thought process, as if I were the one thinking it: **Digging into virtio_fs.c for Completion Handling** Okay, so we're looking at completion handling within virtio-fs. My initial focus is definitely going to be on `virtio_fs_request_complete`. That's where the rubber meets the road, where the kernel signals a request is finished. I need to understand exactly how the data gets cleaned up, how errors are reported back (if any), and how the whole thing transitions to the next phase in the request lifecycle. I'll likely be checking the surrounding code for how that function is called and where the information needed to complete the request comes from in the first place. I’m thinking there might be several critical points there. And I'll be keeping an eye out for any potential race conditions or edge cases. Time to dig in! |
| 14/2 | 2026/08/28 00:06 | tool | grepper |
0mArgs:{
"Expression": "virtio_fs_request_complete",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/virtio_fs.c=813=static void virtio_fs_fixup_stale_error(struct fuse_req *req)\n--\nfs/fuse/virtio_fs.c-843-/* Work function for request completion */\nfs/fuse/virtio_fs.c:844:static void virtio_fs_request_complete(struct fuse_req *req,\nfs/fuse/virtio_fs.c-845-\t\t\t\t struct virtio_fs_vq *fsvq)\n--\nfs/fuse/virtio_fs.c=881=static void virtio_fs_complete_req_work(struct work_struct *work)\n--\nfs/fuse/virtio_fs.c-885-\nfs/fuse/virtio_fs.c:886:\tvirtio_fs_request_complete(w-\u003ereq, w-\u003efsvq);\nfs/fuse/virtio_fs.c-887-\tkfree(w);\n--\nfs/fuse/virtio_fs.c=890=static void virtio_fs_requests_done_work(struct work_struct *work)\n--\nfs/fuse/virtio_fs.c-931-\t\t} else {\nfs/fuse/virtio_fs.c:932:\t\t\tvirtio_fs_request_complete(req, fsvq);\nfs/fuse/virtio_fs.c-933-\t\t}\n"
} |
| 15/2 | 2026/08/28 00:06 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 17031 output: 26 thoughts: 1009 Thoughts: **Analyzing FUSE/VirtioFS Symbol Visibility** Okay, let's break this down. My primary concern is the visibility of certain FUSE and VirtioFS functions, specifically to determine which ones are exposed as proper symbols. The goal is to identify API entry points, favoring those that are non-static and not inlined because these are more likely to be accessible in a predictable way. First, I confirmed that `fuse_do_setattr` is indeed non-static, a good start. Then, I quickly scanned other functions within `fs/fuse/dir.c`, and `fs/fuse/file.c` to identify other functions of interest: `fuse_open`, `fuse_dir_open`, `fuse_do_getattr`, `fuse_statfs`, `fuse_readlink_folio`, and `virtio_fs_request_complete`. Looking at the diff, it seems several of these have been modified: `fuse_do_getattr`, `fuse_readlink_folio`, `fuse_dir_open`, `fuse_do_setattr` (in `fs/fuse/dir.c`) and `fuse_open` (in `fs/fuse/file.c`). Additionally, `fuse_statfs` is changed in `fs/fuse/inode.c`, and there are changes in `fs/fuse/virtio_fs.c` related to `virtio_fs_fixup_stale_error` and `virtio_fs_request_complete`. The `fuse_stale_inode_err` function is also now an inline function defined in `fs/fuse/fuse_i.h`. I then made a note of the required configuration options: `FUSE_FS` and `VIRTIO_FS`. A quick cross-reference of the Kconfig showed that `VIRTIO_FS` depends on `FUSE_FS` and `FUSE_FS` selects `FS_POSIX_ACL` and `FS_IOMAP`. Now, the focus is on a subset of symbols: `fuse_do_setattr`, `fuse_do_getattr`, `fuse_dir_open`, `fuse_open`, `fuse_readlink_folio`, `fuse_statfs`, and `virtio_fs_request_complete`. I need to determine if these are compiled as distinct symbols. `fuse_do_setattr` has already been established as non-static. However, after careful review, it looks like `fuse_open`, `fuse_dir_open`, and `fuse_statfs` are static file_operations/super_operations callbacks. This is good because even though they are static, because their address is taken and assigned into a struct function pointer, they are not inlined. `fuse_do_getattr` and `fuse_readlink_folio` are both static helpers. And `virtio_fs_request_complete` is static as well. Therefore, `fuse_do_setattr`, `fuse_open`, `fuse_dir_open`, and `fuse_statfs` are the significant symbols to focus on. They are *likely* the primary exposed API entry points in the module. |
| 16/2 | 2026/08/28 00:07 | tool | grepper |
0mArgs:{
"Expression": "fuse_open",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/dev.c=773=static void fuse_adjust_compat(struct fuse_chan *fch, struct fuse_args *args)\n--\nfs/fuse/dev.c-796-\t\tcase FUSE_CREATE:\nfs/fuse/dev.c:797:\t\t\targs-\u003ein_args[0].size = sizeof(struct fuse_open_in);\nfs/fuse/dev.c-798-\t\t\tbreak;\n--\nfs/fuse/dir.c=823=static int fuse_create_open(struct mnt_idmap *idmap, struct inode *dir,\n--\nfs/fuse/dir.c-831-\tstruct fuse_create_in inarg;\nfs/fuse/dir.c:832:\tstruct fuse_open_out *outopenp;\nfs/fuse/dir.c-833-\tstruct fuse_entry_out outentry;\n--\nfs/fuse/dir.c=1903=static int fuse_dir_open(struct inode *inode, struct file *file)\n--\nfs/fuse/dir.c-1916-\t/*\nfs/fuse/dir.c:1917:\t * As in fuse_open_common(): a path walk stands behind this open,\nfs/fuse/dir.c-1918-\t * so the refusal is EOPENSTALE for path_openat() to answer.\n--\nfs/fuse/file.c=25=static int fuse_send_open(struct fuse_mount *fm, u64 nodeid,\nfs/fuse/file.c-26-\t\t\t unsigned int open_flags, int opcode,\nfs/fuse/file.c:27:\t\t\t struct fuse_open_out *outargp)\nfs/fuse/file.c-28-{\nfs/fuse/file.c:29:\tstruct fuse_open_in inarg;\nfs/fuse/file.c-30-\tFUSE_ARGS(args);\n--\nfs/fuse/file.c=133=struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid,\n--\nfs/fuse/file.c-158-\t\t/* Store outarg for fuse_finish_open() */\nfs/fuse/file.c:159:\t\tstruct fuse_open_out *outargp = \u0026ff-\u003eargs-\u003eopen_outarg;\nfs/fuse/file.c-160-\t\tint err;\n--\nfs/fuse/file.c=237=static void fuse_truncate_update_attr(struct inode *inode, struct file *file)\n--\nfs/fuse/file.c-249-\nfs/fuse/file.c:250:static int fuse_open(struct inode *inode, struct file *file)\nfs/fuse/file.c-251-{\n--\nfs/fuse/file.c=3088=static const struct file_operations fuse_file_operations = {\n--\nfs/fuse/file.c-3092-\t.mmap\t\t= fuse_file_mmap,\nfs/fuse/file.c:3093:\t.open\t\t= fuse_open,\nfs/fuse/file.c-3094-\t.flush\t\t= fuse_flush,\n--\nfs/fuse/fuse_i.h=333=union fuse_file_args {\nfs/fuse/fuse_i.h-334-\t/* Used during open() */\nfs/fuse/fuse_i.h:335:\tstruct fuse_open_out open_outarg;\nfs/fuse/fuse_i.h-336-\t/* Used during release() */\n"
} |
| 17/2 | 2026/08/28 00:07 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 19639 output: 28 thoughts: 22 Thoughts: Here's my take on those thoughts, tailored for an expert audience: **Diving into `fuse_dir_open`** Okay, time to dissect the usage of `fuse_dir_open` within `fs/fuse/dir.c`. I need to understand its role and how it's being leveraged in the FUSE filesystem layer. I'm assuming there's some issue that warrants investigation, or perhaps I'm looking to optimize directory operations. Regardless, the first step is always to go straight to the source and see *how* this crucial function is being called and what context is shaping its execution. I want to see how the fuse daemon interacts with the kernel space. Knowing where it is being called from will help inform my understanding of the interactions between userspace and the kernel, and the resources that it may be consuming. I'll be looking for potential bottlenecks, race conditions, or maybe even opportunities to reduce unnecessary system calls or improve caching strategies related to directory handling within the FUSE framework. Let's see what's what. |
| 18/2 | 2026/08/28 00:07 | tool | grepper |
0mArgs:{
"Expression": "fuse_dir_open",
"PathPrefix": "fs/fuse"
}Results: {
"Output": "fs/fuse/dir.c=1866=static const char *fuse_get_link(struct dentry *dentry, struct inode *inode,\n--\nfs/fuse/dir.c-1902-\nfs/fuse/dir.c:1903:static int fuse_dir_open(struct inode *inode, struct file *file)\nfs/fuse/dir.c-1904-{\n--\nfs/fuse/dir.c=2448=static const struct file_operations fuse_dir_operations = {\n--\nfs/fuse/dir.c-2451-\t.iterate_shared\t= fuse_readdir,\nfs/fuse/dir.c:2452:\t.open\t\t= fuse_dir_open,\nfs/fuse/dir.c-2453-\t.release\t= fuse_dir_release,\n"
} |
| 19/2 | 2026/08/28 00:07 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 20125 output: 186 thoughts: 516 Thoughts: **My Analysis of the FUSE and Virtio-fs Changes** Okay, let's break this down. I see that `fuse_open` is hooked up to `fuse_file_operations.open`, and `fuse_dir_open` to `fuse_dir_operations.open`. `fuse_statfs` is handling the `stat_fs` super operation. `fuse_do_setattr` is now exposed, and I see it's declared in `fuse_i.h`, accessible from outside, and `fuse_do_getattr` is called within `dir.c`. Also, `virtio_fs_request_complete`, is being called by the virtio-fs completion routines in `virtio_fs.c`. I've got a good handle on where these changes touch the codebase. The modified files include `fs/fuse/dir.c`, `fs/fuse/file.c`, `fs/fuse/fuse_i.h`, `fs/fuse/inode.c`, and of course `fs/fuse/virtio_fs.c`, plus the selftests. As for the configuration options, `FUSE_FS` and `VIRTIO_FS` are the ones relevant to this change. No other files are modified in kernel space. Now, I've got a solid list of key symbols for further analysis: `fuse_do_setattr`, `fuse_open`, `fuse_dir_open`, `fuse_do_getattr`, `fuse_statfs`, `fuse_readlink_folio`, and `virtio_fs_request_complete`. And here are the relevant configs I need to consider for testing: `FUSE_FS`, and `VIRTIO_FS`. This is definitely worth fuzzing. The patch is about improving error handling in FUSE and virtio-fs, specifically when live node ID requests fail with -ENOENT. It's translating those errors to -ESTALE (for getattr, setattr, readlink, statfs) or -EOPENSTALE (for open/opendir) so the VFS layer can retry the path resolution with LOOKUP_REVAL. This touches core FUSE behavior across several operations, both standard FUSE mounts and virtio-fs. Testing this thoroughly is important. |
| 20/2 | 2026/08/28 00:07 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"FUSE_FS",
"VIRTIO_FS"
],
"FocusSymbols": [
"fuse_do_setattr",
"fuse_open",
"fuse_dir_open",
"fuse_do_getattr",
"fuse_statfs",
"fuse_readlink_folio",
"virtio_fs_request_complete"
],
"Reasoning": "The patch updates error handling for live node IDs in FUSE and virtio-fs when the user/host server returns -ENOENT, translating it to -ESTALE or -EOPENSTALE to trigger VFS path lookup retries (LOOKUP_REVAL). These functional changes impact core file operations (open, getattr, setattr, readlink, statfs) in FUSE and virtio-fs.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"FUSE_FS",
"VIRTIO_FS"
],
"FocusSymbols": [
"fuse_do_setattr",
"fuse_open",
"fuse_dir_open",
"fuse_do_getattr",
"fuse_statfs",
"fuse_readlink_folio",
"virtio_fs_request_complete"
],
"Reasoning": "The patch updates error handling for live node IDs in FUSE and virtio-fs when the user/host server returns -ENOENT, translating it to -ESTALE or -EOPENSTALE to trigger VFS path lookup retries (LOOKUP_REVAL). These functional changes impact core file operations (open, getattr, setattr, readlink, statfs) in FUSE and virtio-fs.",
"WorthFuzzing": true
} |
| 21/1 | 2026/08/28 00:07 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 22/2 | 2026/08/28 00:07 | agent | kmsan-evaluator |
0mModel:core Args: null Results: {
"KMSANReasoning": "The patch series modifies error code handling in FUSE and virtio-fs by translating -ENOENT responses to -ESTALE or -EOPENSTALE for operations referencing inodes by nodeid (e.g., FUSE_OPEN, FUSE_OPENDIR, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK, FUSE_STATFS) to enable VFS path lookup retries (retry_estale).\n\nThis change purely alters integer return values/errno codes in error paths. It does not introduce or modify any memory allocations, structure initializations, buffer copies to userspace, or data length calculations. There is no risk of uninitialized memory access or information disclosure that would require KMSAN detection. Any control flow or functional regression issues are covered by standard testing and KASAN builds.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit b4cca34b6fee94863b1be203920938e1f4af9be4
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 28 00:05:30 2026 +0000
syz-cluster: applied patch under review
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index e49b4e874b15f..217a039990507 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1532,6 +1532,8 @@ static int fuse_do_getattr(struct mnt_idmap *idmap, struct inode *inode,
if (stat)
fuse_fillattr(idmap, inode, &outarg.attr, stat);
}
+ } else {
+ err = fuse_stale_inode_err(err);
}
return err;
}
@@ -1848,6 +1850,7 @@ static int fuse_readlink_folio(struct inode *inode, struct folio *folio)
fuse_invalidate_atime(inode);
+ res = fuse_stale_inode_err(res);
if (res < 0)
return res;
@@ -1910,6 +1913,12 @@ static int fuse_dir_open(struct inode *inode, struct file *file)
return err;
err = fuse_do_open(fm, get_node_id(inode), file, true);
+ /*
+ * As in fuse_open_common(): a path walk stands behind this open,
+ * so the refusal is EOPENSTALE for path_openat() to answer.
+ */
+ if (err == -ENOENT)
+ err = -EOPENSTALE;
if (!err) {
struct fuse_file *ff = file->private_data;
@@ -2249,6 +2258,7 @@ int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
if (err) {
if (err == -EINTR)
fuse_invalidate_attr(inode);
+ err = fuse_stale_inode_err(err);
goto error;
}
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 8d6135a6108a4..308b15c30f34d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -279,6 +279,17 @@ static int fuse_open(struct inode *inode, struct file *file)
fuse_set_nowrite(inode);
err = fuse_do_open(fm, get_node_id(inode), file, false);
+ /*
+ * This open reached the server through a path walk, so a refusal
+ * for the live nodeid is reported as EOPENSTALE rather than the
+ * ESTALE the nodeid-only requests say: path_openat() picks the
+ * cheapest retry for the walk in progress, ECHILD under LOOKUP_RCU
+ * and ESTALE otherwise. fuse_file_open() is left alone because
+ * fuse_priv_ioctl_prepare() reaches it to serve FS_IOC_GETFLAGS,
+ * with no open behind it to translate the internal errno.
+ */
+ if (err == -ENOENT)
+ err = -EOPENSTALE;
if (!err) {
ff = file->private_data;
err = fuse_finish_open(inode, file);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index c8d4c5f3af7e8..e6b2597d6dd6f 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -1250,6 +1250,25 @@ void fuse_inode_uncached_io_end(struct fuse_inode *fi);
int fuse_file_io_open(struct file *file, struct inode *inode);
void fuse_file_io_release(struct fuse_file *ff, struct inode *inode);
+/*
+ * Report a request refused for a live nodeid as stale.
+ *
+ * A request that names a nodeid and nothing else is only sent for an
+ * inode the client has looked up and holds a reference to, and the
+ * server owes the client that inode until it is sent FUSE_FORGET.
+ * ENOENT from the server describes the inode itself rather than a name
+ * that has gone away. Report the handle as stale, which the caller
+ * answers by resolving the name again under LOOKUP_REVAL and acting on
+ * whatever it refers to now. A name that really has gone fails that
+ * second lookup and the caller still sees ENOENT.
+ */
+static inline int fuse_stale_inode_err(int err)
+{
+ if (err == -ENOENT)
+ return -ESTALE;
+ return err;
+}
+
/* file.c */
struct fuse_file *fuse_file_open(struct fuse_mount *fm, u64 nodeid,
unsigned int open_flags, bool isdir);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index e9552be3637bc..cde0a53350897 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -666,7 +666,7 @@ static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)
err = fuse_simple_request(fm, &args);
if (!err)
convert_fuse_statfs(buf, &outarg.st);
- return err;
+ return fuse_stale_inode_err(err);
}
static struct fuse_sync_bucket *fuse_sync_bucket_alloc(void)
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index f15e516ebcb5c..7b03bf87c2ae8 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -780,6 +780,66 @@ static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
return true;
}
+/*
+ * Report a request refused for a live nodeid as stale.
+ *
+ * These requests carry a nodeid and no name, so the client only sends them for
+ * an inode it has already looked up and holds a reference to, and a server owes
+ * the client that inode until it is sent FUSE_FORGET. A server answering with
+ * ENOENT is describing a handle it was obliged to honour rather than a name
+ * that has gone away, and the caller has no reason to doubt it.
+ *
+ * Saying the handle is stale is something the caller knows how to answer: it
+ * repeats the lookup under LOOKUP_REVAL and acts on whatever the name refers to
+ * now. A name that genuinely has gone fails the retried lookup, so a caller
+ * still learns it is gone. retry_estale() is what does this, and fs/namei.c,
+ * fs/open.c, fs/stat.c, fs/statfs.c, fs/utimes.c and fs/xattr.c all reach it,
+ * which is what makes the conversion useful rather than a rename of the error.
+ *
+ * A request that names something which can itself be absent is left alone,
+ * because ENOENT is then ambiguous and is frequently the answer the caller
+ * asked for. FUSE_LOOKUP reports a missing name in a living directory and the
+ * directory operations carry a parent nodeid beside one, so neither can be
+ * read as a statement about the inode. The extended attribute requests belong
+ * with them: they carry an attribute name, and while a server should report a
+ * missing attribute as ENODATA, one that answers ENOENT instead would have a
+ * correct reply turned into a retry that cannot succeed.
+ *
+ * Requests against an already open descriptor are also left alone, since there
+ * is no equivalent retry to reach and converting the error would rename a
+ * failure rather than repair it, and FUSE_IOCTL and FUSE_POLL hand the
+ * server's errno to userspace verbatim.
+ */
+static void virtio_fs_fixup_stale_error(struct fuse_req *req)
+{
+ if (req->out.h.error != -ENOENT)
+ return;
+
+ switch (req->in.h.opcode) {
+ case FUSE_OPEN:
+ case FUSE_OPENDIR:
+ /*
+ * An open says EOPENSTALE, and path_openat() decides what the
+ * walk in progress should make of it: ECHILD under LOOKUP_RCU
+ * so it drops to REF-walk, ESTALE otherwise so the name is
+ * resolved again under LOOKUP_REVAL. Naming ESTALE here would
+ * take the second in both cases and skip a cheaper retry.
+ */
+ req->out.h.error = -EOPENSTALE;
+ break;
+ case FUSE_GETATTR:
+ case FUSE_SETATTR:
+ case FUSE_READLINK:
+ case FUSE_STATFS:
+ /*
+ * Nothing translates EOPENSTALE outside the open path, so
+ * these say ESTALE directly, which retry_estale() answers.
+ */
+ req->out.h.error = -ESTALE;
+ break;
+ }
+}
+
/* Work function for request completion */
static void virtio_fs_request_complete(struct fuse_req *req,
struct virtio_fs_vq *fsvq)
@@ -810,6 +870,8 @@ static void virtio_fs_request_complete(struct fuse_req *req,
clear_bit(FR_SENT, &req->flags);
+ virtio_fs_fixup_stale_error(req);
+
fuse_request_end(req);
spin_lock(&fsvq->lock);
dec_in_flight_req(fsvq);
diff --git a/tools/testing/selftests/filesystems/fuse/.gitignore b/tools/testing/selftests/filesystems/fuse/.gitignore
index fb51603fe4198..9cb3048128d5b 100644
--- a/tools/testing/selftests/filesystems/fuse/.gitignore
+++ b/tools/testing/selftests/filesystems/fuse/.gitignore
@@ -1,4 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
+fuse_acl_cache_test
fuse_mnt
+fuse_estale_test
fusectl_test
write_extend_eof_test
diff --git a/tools/testing/selftests/filesystems/fuse/Makefile b/tools/testing/selftests/filesystems/fuse/Makefile
index 95a1ee947ca76..f564cb37b3a5b 100644
--- a/tools/testing/selftests/filesystems/fuse/Makefile
+++ b/tools/testing/selftests/filesystems/fuse/Makefile
@@ -6,11 +6,12 @@ TEST_GEN_PROGS := fusectl_test
TEST_GEN_PROGS += write_extend_eof_test
TEST_GEN_FILES := fuse_mnt
-# fuse_acl_cache_test requires libfuse3; add it only when the library is present.
-ACL_CFLAGS := $(shell pkg-config fuse3 --cflags 2>/dev/null)
-ACL_LDLIBS := $(shell pkg-config fuse3 --libs 2>/dev/null)
-ifneq ($(ACL_CFLAGS),)
+# These tests require libfuse3; add them only when the library is present.
+FUSE3_CFLAGS := $(shell pkg-config fuse3 --cflags 2>/dev/null)
+FUSE3_LDLIBS := $(shell pkg-config fuse3 --libs 2>/dev/null)
+ifneq ($(FUSE3_CFLAGS),)
TEST_GEN_PROGS += fuse_acl_cache_test
+TEST_GEN_PROGS += fuse_estale_test
endif
include ../../lib.mk
@@ -30,5 +31,8 @@ endif
$(OUTPUT)/fuse_mnt: CFLAGS += $(VAR_CFLAGS)
$(OUTPUT)/fuse_mnt: LDLIBS += $(VAR_LDLIBS)
-$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(ACL_CFLAGS)
-$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(ACL_LDLIBS)
+$(OUTPUT)/fuse_acl_cache_test: CFLAGS += $(FUSE3_CFLAGS)
+$(OUTPUT)/fuse_acl_cache_test: LDLIBS += $(FUSE3_LDLIBS)
+
+$(OUTPUT)/fuse_estale_test: CFLAGS += $(FUSE3_CFLAGS)
+$(OUTPUT)/fuse_estale_test: LDLIBS += $(FUSE3_LDLIBS)
diff --git a/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c
new file mode 100644
index 0000000000000..82b842d3a5f7b
--- /dev/null
+++ b/tools/testing/selftests/filesystems/fuse/fuse_estale_test.c
@@ -0,0 +1,450 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Test: a request refused for an inode the client still holds a reference to
+ *
+ * FUSE_OPEN, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and FUSE_STATFS carry a
+ * nodeid rather than a path. The client only sends them for an inode it has
+ * already looked up and holds a reference to, and a server owes the client that
+ * inode until it is sent FUSE_FORGET. A server that lets the inode go early,
+ * as one backing a shared directory does when the name is renamed over, answers
+ * with ENOENT.
+ *
+ * On an unfixed kernel that ENOENT is passed out unchanged. The path walk has
+ * no reason to doubt it and the caller is told a file is missing when it never
+ * stopped existing. Callers that read a missing file as an empty one act on
+ * the emptiness.
+ *
+ * Fixed (fs/fuse/file.c and fs/fuse/dir.c): ENOENT becomes ESTALE, which
+ * describes the handle rather than the name. filename_lookup() and
+ * do_filp_open() already retry with LOOKUP_REVAL on ESTALE, so the name is
+ * resolved again and the inode it refers to now is used. A name that has
+ * genuinely gone away fails the retried lookup, so ENOENT still reaches a
+ * caller that deserves it.
+ *
+ * Only requests reachable through a path walk are covered, because the retry
+ * is what makes ESTALE useful and the walk is what performs it. An operation
+ * on a descriptor already open has no equivalent recovery.
+ *
+ * Test outline:
+ * 1. Mount a minimal FUSE fs holding one file.
+ * 2. The server refuses the first request of the kind under test and allows
+ * every one after it, standing in for a server that released the inode and
+ * has since resolved the name again.
+ * 3. openat() the file.
+ * Buggy: ENOENT reaches the caller, one open was asked for. FAIL.
+ * Fixed: the walk retries, the second open is allowed, the descriptor is
+ * returned, two opens were asked for. PASS.
+ * 4. stat(), chmod(), readlink() and statfs() by name, which are the same
+ * recovery through FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK and
+ * FUSE_STATFS. Each is reached through a path walk, which is what makes
+ * the retry available.
+ * 5. Open a name the server does not have at all.
+ * Both: ENOENT, because the lookup fails rather than the open, and a
+ * file that is absent must still look absent.
+ */
+
+#define _GNU_SOURCE
+#define FUSE_USE_VERSION 34
+
+#include <errno.h>
+#include <fcntl.h>
+#include <fuse_lowlevel.h>
+#include <linux/limits.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/statvfs.h>
+#include <sys/vfs.h>
+#include <unistd.h>
+
+#include "../../kselftest_harness.h"
+
+#define FILE_NAME "held"
+#define LINK_NAME "held-link"
+#define ABSENT_NAME "no-such-file"
+#define FILE_INO 2
+#define LINK_INO 3
+#define CONTENTS "present\n"
+#define LINK_TARGET FILE_NAME
+
+/*
+ * Which request the server refuses, and how many times. Shared with the
+ * daemon thread; one test runs at a time, so plain ints.
+ *
+ * Every one of these names an inode by nodeid rather than by name, so a
+ * refusal of any of them is describing a handle rather than a missing file.
+ * FUSE_LOOKUP is deliberately absent: it carries a name, so its ENOENT is an
+ * answer rather than a fault, and absent_name_still_reports_absent covers it.
+ */
+enum refuse_what {
+ REFUSE_NOTHING,
+ REFUSE_OPEN,
+ REFUSE_GETATTR,
+ REFUSE_SETATTR,
+ REFUSE_READLINK,
+ REFUSE_STATFS,
+};
+
+static struct {
+ enum refuse_what what;
+ int refusals_left;
+ int opens_seen;
+ int getattrs_seen;
+ int setattrs_seen;
+ int readlinks_seen;
+ int statfss_seen;
+} g_ds;
+
+/* True once, for the request under test, and then never again. */
+static bool refuse_now(enum refuse_what what)
+{
+ if (g_ds.what != what || g_ds.refusals_left <= 0)
+ return false;
+ g_ds.refusals_left--;
+ return true;
+}
+
+static void fill_attr(fuse_ino_t ino, struct stat *st)
+{
+ memset(st, 0, sizeof(*st));
+ st->st_ino = ino;
+ /*
+ * Owned by whoever runs the test, so that chmod() is a request the
+ * kernel will carry through to the server rather than refuse itself.
+ */
+ st->st_uid = getuid();
+ st->st_gid = getgid();
+ if (ino == FUSE_ROOT_ID) {
+ st->st_mode = S_IFDIR | 0755;
+ st->st_nlink = 2;
+ } else if (ino == LINK_INO) {
+ st->st_mode = S_IFLNK | 0777;
+ st->st_nlink = 1;
+ st->st_size = sizeof(LINK_TARGET) - 1;
+ } else {
+ st->st_mode = S_IFREG | 0644;
+ st->st_nlink = 1;
+ st->st_size = sizeof(CONTENTS) - 1;
+ }
+}
+
+static void t_lookup(fuse_req_t req, fuse_ino_t parent, const char *name)
+{
+ struct fuse_entry_param e;
+ fuse_ino_t ino;
+
+ if (parent != FUSE_ROOT_ID)
+ ino = 0;
+ else if (!strcmp(name, FILE_NAME))
+ ino = FILE_INO;
+ else if (!strcmp(name, LINK_NAME))
+ ino = LINK_INO;
+ else
+ ino = 0;
+
+ if (!ino) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ memset(&e, 0, sizeof(e));
+ e.ino = ino;
+ e.attr_timeout = 0;
+ e.entry_timeout = 0;
+ fill_attr(ino, &e.attr);
+ fuse_reply_entry(req, &e);
+}
+
+static void t_getattr(fuse_req_t req, fuse_ino_t ino,
+ struct fuse_file_info *fi)
+{
+ struct stat st;
+
+ (void)fi;
+ /* The root is left alone; refusing it would break the mount itself. */
+ if (ino == FILE_INO) {
+ g_ds.getattrs_seen++;
+ if (refuse_now(REFUSE_GETATTR)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ }
+ fill_attr(ino, &st);
+ fuse_reply_attr(req, &st, 0);
+}
+
+static void t_open(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi)
+{
+ if (ino != FILE_INO) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ g_ds.opens_seen++;
+ if (refuse_now(REFUSE_OPEN)) {
+ /*
+ * The inode is gone as far as this server is concerned, even
+ * though the client is holding a reference to it and asked by
+ * nodeid rather than by name.
+ */
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ fuse_reply_open(req, fi);
+}
+
+static void t_read(fuse_req_t req, fuse_ino_t ino, size_t size, off_t off,
+ struct fuse_file_info *fi)
+{
+ size_t len = sizeof(CONTENTS) - 1;
+
+ (void)fi;
+ if (ino != FILE_INO) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ if ((size_t)off >= len) {
+ fuse_reply_buf(req, NULL, 0);
+ return;
+ }
+ if (off + size > len)
+ size = len - off;
+ fuse_reply_buf(req, CONTENTS + off, size);
+}
+
+static void t_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr,
+ int to_set, struct fuse_file_info *fi)
+{
+ struct stat st;
+
+ (void)attr;
+ (void)to_set;
+ (void)fi;
+ if (ino == FILE_INO) {
+ g_ds.setattrs_seen++;
+ if (refuse_now(REFUSE_SETATTR)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ }
+ fill_attr(ino, &st);
+ fuse_reply_attr(req, &st, 0);
+}
+
+static void t_readlink(fuse_req_t req, fuse_ino_t ino)
+{
+ if (ino != LINK_INO) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
+ g_ds.readlinks_seen++;
+ if (refuse_now(REFUSE_READLINK)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+ fuse_reply_readlink(req, LINK_TARGET);
+}
+
+static void t_statfs(fuse_req_t req, fuse_ino_t ino)
+{
+ struct statvfs sfs;
+
+ (void)ino;
+ g_ds.statfss_seen++;
+ if (refuse_now(REFUSE_STATFS)) {
+ fuse_reply_err(req, ENOENT);
+ return;
+ }
+
+ memset(&sfs, 0, sizeof(sfs));
+ sfs.f_bsize = 512;
+ sfs.f_frsize = 512;
+ sfs.f_namemax = NAME_MAX;
+ fuse_reply_statfs(req, &sfs);
+}
+
+static const struct fuse_lowlevel_ops fs_ops = {
+ .lookup = t_lookup,
+ .getattr = t_getattr,
+ .setattr = t_setattr,
+ .readlink = t_readlink,
+ .statfs = t_statfs,
+ .open = t_open,
+ .read = t_read,
+};
+
+static void *run_daemon(void *arg)
+{
+ fuse_session_loop((struct fuse_session *)arg);
+ return NULL;
+}
+
+/* ---- kselftest harness --------------------------------------------------- */
+
+FIXTURE(open_estale) {
+ struct fuse_session *se;
+ char mountpoint[PATH_MAX];
+ char file_path[PATH_MAX];
+ char link_path[PATH_MAX];
+ char absent_path[PATH_MAX];
+ pthread_t thread;
+};
+
+FIXTURE_SETUP(open_estale)
+{
+ char *fuse_argv[] = { "fuse_estale_test", NULL };
+ struct fuse_args args = FUSE_ARGS_INIT(1, fuse_argv);
+
+ memset(&g_ds, 0, sizeof(g_ds));
+ g_ds.what = REFUSE_NOTHING;
+ g_ds.refusals_left = 1;
+
+ strcpy(self->mountpoint, "/tmp/open_estale_test_XXXXXX");
+ if (!mkdtemp(self->mountpoint))
+ SKIP(return, "mkdtemp: %s", strerror(errno));
+
+ snprintf(self->file_path, sizeof(self->file_path),
+ "%s/" FILE_NAME, self->mountpoint);
+ snprintf(self->link_path, sizeof(self->link_path),
+ "%s/" LINK_NAME, self->mountpoint);
+ snprintf(self->absent_path, sizeof(self->absent_path),
+ "%s/" ABSENT_NAME, self->mountpoint);
+
+ self->se = fuse_session_new(&args, &fs_ops, sizeof(fs_ops), NULL);
+ if (!self->se) {
+ rmdir(self->mountpoint);
+ SKIP(return, "fuse_session_new failed");
+ }
+
+ if (fuse_session_mount(self->se, self->mountpoint)) {
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+ SKIP(return, "fuse_session_mount failed (no fusermount3 or no privileges)");
+ }
+
+ if (pthread_create(&self->thread, NULL, run_daemon, self->se)) {
+ fuse_session_unmount(self->se);
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+ SKIP(return, "pthread_create: %s", strerror(errno));
+ }
+
+ fuse_opt_free_args(&args);
+}
+
+FIXTURE_TEARDOWN(open_estale)
+{
+ fuse_session_exit(self->se);
+ fuse_session_unmount(self->se);
+ pthread_join(self->thread, NULL);
+ fuse_session_destroy(self->se);
+ rmdir(self->mountpoint);
+}
+
+TEST_F(open_estale, refused_open_is_retried)
+{
+ int fd;
+
+ g_ds.what = REFUSE_OPEN;
+
+ fd = open(self->file_path, O_RDONLY);
+
+ /*
+ * The refusal describes a handle the server should have honoured, so
+ * the walk is entitled to resolve the name again and open what it
+ * refers to now. Reporting the file missing instead ends the walk.
+ */
+ ASSERT_GE(fd, 0) {
+ TH_LOG("open failed with %s after %d open request(s)",
+ strerror(errno), g_ds.opens_seen);
+ }
+ EXPECT_EQ(2, g_ds.opens_seen);
+ close(fd);
+}
+
+TEST_F(open_estale, refused_getattr_on_path_is_retried)
+{
+ struct stat st;
+
+ g_ds.what = REFUSE_GETATTR;
+
+ /*
+ * Reached by name, so the walk can resolve it again and ask a second
+ * time, the same recovery the open gets.
+ */
+ ASSERT_EQ(0, stat(self->file_path, &st)) {
+ TH_LOG("stat failed with %s after %d getattr request(s)",
+ strerror(errno), g_ds.getattrs_seen);
+ }
+ EXPECT_GT(g_ds.getattrs_seen, 1);
+}
+
+TEST_F(open_estale, refused_setattr_on_path_is_retried)
+{
+ g_ds.what = REFUSE_SETATTR;
+
+ /*
+ * chmod() reaches the inode by name, so the same retry applies: the
+ * refusal describes a handle and the walk may resolve the name again.
+ */
+ ASSERT_EQ(0, chmod(self->file_path, 0600)) {
+ TH_LOG("chmod failed with %s after %d setattr request(s)",
+ strerror(errno), g_ds.setattrs_seen);
+ }
+ EXPECT_GT(g_ds.setattrs_seen, 1);
+}
+
+TEST_F(open_estale, refused_readlink_on_path_is_retried)
+{
+ char buf[PATH_MAX];
+ ssize_t n;
+
+ g_ds.what = REFUSE_READLINK;
+
+ n = readlink(self->link_path, buf, sizeof(buf) - 1);
+ ASSERT_GE(n, 0) {
+ TH_LOG("readlink failed with %s after %d readlink request(s)",
+ strerror(errno), g_ds.readlinks_seen);
+ }
+ buf[n] = '\0';
+ EXPECT_STREQ(LINK_TARGET, buf);
+ EXPECT_GT(g_ds.readlinks_seen, 1);
+}
+
+TEST_F(open_estale, refused_statfs_on_path_is_retried)
+{
+ struct statfs sfs;
+
+ g_ds.what = REFUSE_STATFS;
+
+ /*
+ * statfs() describes the mount rather than the file, but it is still
+ * reached through a path walk, so a refusal that names a handle is
+ * retried the same way.
+ */
+ ASSERT_EQ(0, statfs(self->file_path, &sfs)) {
+ TH_LOG("statfs failed with %s after %d statfs request(s)",
+ strerror(errno), g_ds.statfss_seen);
+ }
+ EXPECT_GT(g_ds.statfss_seen, 1);
+}
+
+TEST_F(open_estale, absent_name_still_reports_absent)
+{
+ int fd;
+
+ /*
+ * Here it is the lookup that fails rather than the open, so nothing is
+ * being described as stale and the caller must still be told the name
+ * is not there.
+ */
+ fd = open(self->absent_path, O_RDONLY);
+ ASSERT_LT(fd, 0);
+ EXPECT_EQ(ENOENT, errno);
+}
+
+TEST_HARNESS_MAIN
|
| 23/3 | 2026/08/28 00:07 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10129 output: 195 thoughts: 1240 Thoughts: **Analysis of the FUSE Patch Series and KMSAN Fuzzing Needs** Okay, let's break this down. The objective is to determine if this FUSE patch series warrants a dedicated KMSAN fuzzing session. My initial assessment is that it probably doesn't, but let's confirm. The patch focuses on error code translation within the FUSE subsystem. Specifically, it changes how `-ENOENT` is handled, remapping it to `-ESTALE` or `-EOPENSTALE` in various functions (`fuse_do_getattr`, `fuse_readlink_folio`, `fuse_dir_open`, `fuse_do_setattr`, `fuse_open`, `fuse_statfs`, and `virtio_fs_fixup_stale_error`). This modification is intended to make the VFS retry mechanism (`retry_estale()` and `path_openat()`) more effective when dealing with stale node IDs. My concerns with KMSAN typically revolve around uninitialized memory reads, information leaks, and similar vulnerabilities. I need to ascertain if this patch introduces any of those risks. First, I examined whether the patch introduces new memory allocations. No, it doesn't. Second, I checked if the patch is involved in any copy to user space, copy from uninitialized data to the kernel or user buffers. There's no involvement. Third, I inspected if there is any structure padding modification or control flow modifications which could allow reading uninitialized memory. There's no such modification. The core change is simply remapping integer error return codes. To be absolutely sure, I'll go through the standard KMSAN risk areas again: 1. **Kernel structures to userspace**: No new kernel structures are being sent to user space where uninitialized fields or padding might be an issue. 2. **Conditional logic based on uninitialized data**: There's no branching or conditional logic that depends on potentially uninitialized variables. 3. **Complex data structure initialization**: No new allocation or initialization of complex structures where uninitialized fields could be read later. 4. **Bounds checks and buffer manipulations**: There are no modifications to bounds checks, lengths, or logic that would allow reading uninitialized bytes from existing buffers. In short, this is primarily a remapping of error codes to ensure the VFS properly retries stale inodes. KMSAN detects uninitialized memory reads. This patch doesn't introduce any new memory allocations, copy operations, buffer manipulations, or information leaks. Standard KASAN/syzkaller fuzzing should be sufficient to exercise the FUSE filesystem behavior and error-handling paths covered by this patch. A dedicated KMSAN run isn't necessary here. Okay, I'm confident in that conclusion. Let's call the `set-results` tool and mark this as not requiring KMSAN. |
| 24/3 | 2026/08/28 00:07 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch series modifies error code handling in FUSE and virtio-fs by translating -ENOENT responses to -ESTALE or -EOPENSTALE for operations referencing inodes by nodeid (e.g., FUSE_OPEN, FUSE_OPENDIR, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK, FUSE_STATFS) to enable VFS path lookup retries (retry_estale).\n\nThis change purely alters integer return values/errno codes in error paths. It does not introduce or modify any memory allocations, structure initializations, buffer copies to userspace, or data length calculations. There is no risk of uninitialized memory access or information disclosure that would require KMSAN detection. Any control flow or functional regression issues are covered by standard testing and KASAN builds.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch series modifies error code handling in FUSE and virtio-fs by translating -ENOENT responses to -ESTALE or -EOPENSTALE for operations referencing inodes by nodeid (e.g., FUSE_OPEN, FUSE_OPENDIR, FUSE_GETATTR, FUSE_SETATTR, FUSE_READLINK, FUSE_STATFS) to enable VFS path lookup retries (retry_estale).\n\nThis change purely alters integer return values/errno codes in error paths. It does not introduce or modify any memory allocations, structure initializations, buffer copies to userspace, or data length calculations. There is no risk of uninitialized memory access or information disclosure that would require KMSAN detection. Any control flow or functional regression issues are covered by standard testing and KASAN builds.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|