From dde5994fa0c314fb5b0f4020106937db4b12d68c Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Wed, 9 Jul 2025 09:51:52 -0700 Subject: [PATCH] fuse2fs: fix race condition in op_destroy On a regular fuse server (i.e. one not running in fuseblk mode), libfuse synthesizes and dispatches a FUSE_DESTROY command as soon as the event dispatch loop terminates after the kernel disconnects /dev/fuse. Unfortunately, this is done without coordinating with any other threads that may have already received a real FUSE command from the kernel. In other words, FUSE_DESTROY can run in parallel with other fuse_operations. Therefore, we must guard the body of this function with the BKL just like any other fuse operation or risk races within libext2fs. If we're lucky, we trash the ext2_filsys state and generic/488 will crash. [23512.452451] [U] fuse: reading device: Software caused connection abort [23512.453886] [U] fuse: reading device: Software caused connection abort If we're not lucky, it corrupts the ondisk filesystem resulting in a e2fsck complaining as well. Cc: linux-ext4@vger.kernel.org # v1.43 Fixes: 81cbf1ef4f5dab ("misc: add fuse2fs, a FUSE server for e2fsprogs") Signed-off-by: Darrick J. Wong Link: https://lore.kernel.org/r/20250709165152.GE2672022@frogsfrogsfrogs Signed-off-by: Theodore Ts'o --- misc/fuse2fs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/misc/fuse2fs.c b/misc/fuse2fs.c index ff8d4668..f0250bd1 100644 --- a/misc/fuse2fs.c +++ b/misc/fuse2fs.c @@ -728,7 +728,10 @@ static void op_destroy(void *p EXT2FS_ATTR((unused))) translate_error(global_fs, 0, EXT2_ET_BAD_MAGIC); return; } + + pthread_mutex_lock(&ff->bfl); fs = ff->fs; + dbg_printf(ff, "%s: dev=%s\n", __func__, fs->device_name); if (fs->flags & EXT2_FLAG_RW) { fs->super->s_state |= EXT2_VALID_FS; @@ -763,6 +766,8 @@ static void op_destroy(void *p EXT2FS_ATTR((unused))) uuid_unparse(fs->super->s_uuid, uuid); log_printf(ff, "%s %s.\n", _("unmounting filesystem"), uuid); } + + pthread_mutex_unlock(&ff->bfl); } static void *op_init(struct fuse_conn_info *conn -- 2.47.2