[PATCH] fuse: refuse FUSE_NOTIFY_STORE for DAX inodes

[PATCH] fuse: refuse FUSE_NOTIFY_STORE for DAX inodes

[Joas Antonio dos Santos]

Since commit 2fbe4586cff3 ("fuse: add support for opening dax device as
backing"), a regular file is marked S_DAX whenever the server sets
FUSE_ATTR_DAX in the attributes. This does not depend on any INIT flag,
so any FUSE server can do it, including an unprivileged one.

fuse_notify_store() does not check for this. It adds ordinary page cache
folios to the mapping of such an inode with filemap_grab_folio(), while
the DAX code expects that mapping to hold only DAX entries. When the
inode is evicted, fuse_evict_inode() calls dax_break_layout_final(), and
dax_layout_busy_page_range() hits WARN_ON_ONCE(!xa_is_value(entry)):

  WARNING: fs/dax.c:825 at dax_layout_busy_page_range+0x394/0x4dc
  CPU: 0 UID: 65534 PID: 93 Comm: fusedax
  Call trace:
   dax_layout_busy_page_range+0x394/0x4dc (P)
   dax_break_layout_final+0x104/0x278
   fuse_evict_inode+0x2cc/0x57c
   evict+0x2b4/0x748
   iput.part.0+0x51c/0x964
   ...
   fuse_kill_sb_anon+0x170/0x268
   deactivate_locked_super+0x98/0x11c

With panic_on_warn set, this lets an unprivileged FUSE server panic the
machine.

DAX mappings do not hold page cache folios, so storing data into one has
no use. Return -EINVAL, as is already done for files that are not
regular. This also covers virtiofs DAX inodes.

Reproduced on current mainline (arm64, CONFIG_FS_DAX=y) with a FUSE
server running as uid 65534 in a new user and mount namespace, answering
INIT with no flags, LOOKUP with FUSE_ATTR_DAX on a regular file, then
sending FUSE_NOTIFY_STORE for it and unmounting. Before: the WARN above,
and a panic with panic_on_warn=1. After: FUSE_NOTIFY_STORE fails with
EINVAL and nothing is logged. FUSE_NOTIFY_STORE on a regular inode
without FUSE_ATTR_DAX still works.

Found by code review of the DAX backing changes and confirmed with the
reproducer above.

Fixes: 2fbe4586cff3 ("fuse: add support for opening dax device as backing")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
Tool-use note: the code review that found this and the reproducer were
prepared with help from an LLM-based assistant; I reviewed the change
and built and ran the tests myself. Reproducer available on request.

 fs/fuse/notify.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
index 984e4945e..938440474 100644
--- a/fs/fuse/notify.c
+++ b/fs/fuse/notify.c
@@ -167,6 +167,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
 		err = -EINVAL;
 		goto out_iput;
 	}
+	/* DAX mappings do not hold page cache folios */
+	if (IS_DAX(inode)) {
+		err = -EINVAL;
+		goto out_iput;
+	}
 
 	mapping = inode->i_mapping;
 	file_size = i_size_read(inode);
-- 
2.43.0

Re: [PATCH] fuse: refuse FUSE_NOTIFY_STORE for DAX inodes

[John Groves]

On Sat, Oct 31, 2026, at 10:44 AM, Joas Antonio dos Santos wrote:
> Since commit 2fbe4586cff3 ("fuse: add support for opening dax device as
> backing"), a regular file is marked S_DAX whenever the server sets
> FUSE_ATTR_DAX in the attributes. This does not depend on any INIT flag,
> so any FUSE server can do it, including an unprivileged one.
> 
> fuse_notify_store() does not check for this. It adds ordinary page cache
> folios to the mapping of such an inode with filemap_grab_folio(), while
> the DAX code expects that mapping to hold only DAX entries. When the
> inode is evicted, fuse_evict_inode() calls dax_break_layout_final(), and
> dax_layout_busy_page_range() hits WARN_ON_ONCE(!xa_is_value(entry)):
> 
>   WARNING: fs/dax.c:825 at dax_layout_busy_page_range+0x394/0x4dc
>   CPU: 0 UID: 65534 PID: 93 Comm: fusedax
>   Call trace:
>    dax_layout_busy_page_range+0x394/0x4dc (P)
>    dax_break_layout_final+0x104/0x278
>    fuse_evict_inode+0x2cc/0x57c
>    evict+0x2b4/0x748
>    iput.part.0+0x51c/0x964
>    ...
>    fuse_kill_sb_anon+0x170/0x268
>    deactivate_locked_super+0x98/0x11c
> 
> With panic_on_warn set, this lets an unprivileged FUSE server panic the
> machine.
> 
> DAX mappings do not hold page cache folios, so storing data into one has
> no use. Return -EINVAL, as is already done for files that are not
> regular. This also covers virtiofs DAX inodes.
> 
> Reproduced on current mainline (arm64, CONFIG_FS_DAX=y) with a FUSE
> server running as uid 65534 in a new user and mount namespace, answering
> INIT with no flags, LOOKUP with FUSE_ATTR_DAX on a regular file, then
> sending FUSE_NOTIFY_STORE for it and unmounting. Before: the WARN above,
> and a panic with panic_on_warn=1. After: FUSE_NOTIFY_STORE fails with
> EINVAL and nothing is logged. FUSE_NOTIFY_STORE on a regular inode
> without FUSE_ATTR_DAX still works.
> 
> Found by code review of the DAX backing changes and confirmed with the
> reproducer above.
> 
> Fixes: 2fbe4586cff3 ("fuse: add support for opening dax device as backing")
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>

LGTM

Reviewed-by: John Groves <john@groves.net>

> ---
> Tool-use note: the code review that found this and the reproducer were
> prepared with help from an LLM-based assistant; I reviewed the change
> and built and ran the tests myself. Reproducer available on request.
> 
> fs/fuse/notify.c | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
> index 984e4945e..938440474 100644
> --- a/fs/fuse/notify.c
> +++ b/fs/fuse/notify.c
> @@ -167,6 +167,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
> err = -EINVAL;
> goto out_iput;
> }
> + /* DAX mappings do not hold page cache folios */
> + if (IS_DAX(inode)) {
> + err = -EINVAL;
> + goto out_iput;
> + }
>  
> mapping = inode->i_mapping;
> file_size = i_size_read(inode);
> -- 
> 2.43.0
> 
>