From: Li Wang <liwang@kylinos.cn>
Date: Fri, 22 May 2026 08:38:05 +0000 (+0800)
Subject: fuse: use READ_ONCE in fuse_chan_num_background()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=521fed4886ccb3b78846595e843ec9419d343623;p=thirdparty%2Fkernel%2Flinux.git

fuse: use READ_ONCE in fuse_chan_num_background()

fuse_chan_num_background() is called without holding fch->bg_lock (for
example from fuse_writepages() to compare against fc->congestion_threshold),
while fch->num_background is updated under bg_lock in dev.c and dev_uring.c.
This is the same locked-write/lockless-read pattern already used for
max_background in fuse_chan_max_background().

Use READ_ONCE() on the read side so that:

- The compiler does not cache or coalesce loads of a value that may change
  concurrently on another CPU.
- Prevent KCSAN from reporting an unexpected race.

Signed-off-by: Li Wang <liwang@kylinos.cn>
Fixes: 670d21c6e17f ("fuse: remove reliance on bdi congestion")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
---

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 63a2898530232..d09cddd68e035 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -383,7 +383,7 @@ EXPORT_SYMBOL_GPL(fuse_dev_chan_new);
 
 unsigned int fuse_chan_num_background(struct fuse_chan *fch)
 {
-	return fch->num_background;
+	return READ_ONCE(fch->num_background);
 }
 
 unsigned int fuse_chan_max_background(struct fuse_chan *fch)