[PATCH] cuse: wait for pending RCU callbacks on module exit

[PATCH] cuse: wait for pending RCU callbacks on module exit

[Baokun Li]

Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"),
fuse_conn_put() frees the fuse_conn through call_rcu() rather than
synchronously.  For cuse, fc->release is cuse_fc_release(), which
lives in the cuse module.  If the module is removed before the RCU
grace period ends, the callback jumps into freed module memory:

      userspace / module unload      |        RCU softirq
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 close(/dev/cuse)                    |
  cuse_channel_release()             |
   fuse_dev_release()                |
    fuse_conn_put(fch->conn)         |
     call_rcu(delayed_release) ------+---> callback queued
                                     |
 rmmod cuse                          |
  cuse_exit()                        |
   cuse_channel_destroy()            |
   ...                               |
   return                            |
                                     |
 <module text freed>                 |
                                     |  rcu_do_batch()
                                     |   delayed_release()
                                     |    fc->release()
                                     |     -> cuse_fc_release()
                                     |        ^^^ freed text!

The freed module text is unmapped by vfree(), so the jump into the
stale callback triggers a page-fault Oops.  If the virtual address
is subsequently reused, the callback could execute unrelated code
(undefined behaviour).

Fix this by calling rcu_barrier() in cuse_exit() so that any pending
fuse_conn release callback completes before the module is removed.

Fixes: 053fc4f755ad ("fuse: fix UAF in rcu pathwalks")
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
---
 fs/fuse/cuse.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index 3c15b5ba16d7..1c71783ca5a5 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -653,6 +653,11 @@ static void __exit cuse_exit(void)
 {
 	misc_deregister(&cuse_miscdev);
 	class_destroy(cuse_class);
+	/*
+	 * Wait for pending call_rcu() callbacks that call back into
+	 * this module via fc->release (cuse_fc_release).
+	 */
+	rcu_barrier();
 }
 
 module_init(cuse_init);
-- 
2.43.7

Re: [PATCH] cuse: wait for pending RCU callbacks on module exit

[Miklos Szeredi]

On Fri, 14 Aug 2026 at 15:40, Baokun Li <libaokun@linux.alibaba.com> wrote:
>
> Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"),
> fuse_conn_put() frees the fuse_conn through call_rcu() rather than
> synchronously.  For cuse, fc->release is cuse_fc_release(), which
> lives in the cuse module.  If the module is removed before the RCU
> grace period ends, the callback jumps into freed module memory:

free_module() calls synchronize_rcu(), so this should not be an issue.

Thanks,
Miklos

Re: [PATCH] cuse: wait for pending RCU callbacks on module exit

[Baokun Li]

Hi Miklos,

On 2026/8/18 15:33, Miklos Szeredi wrote:
> On Fri, 14 Aug 2026 at 15:40, Baokun Li <libaokun@linux.alibaba.com> wrote:
>> Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"),
>> fuse_conn_put() frees the fuse_conn through call_rcu() rather than
>> synchronously.  For cuse, fc->release is cuse_fc_release(), which
>> lives in the cuse module.  If the module is removed before the RCU
>> grace period ends, the callback jumps into freed module memory:
> free_module() calls synchronize_rcu(), so this should not be an issue.


synchronize_rcu() only waits for pre-existing RCU read-side critical
sections to complete. It does not wait for pending call_rcu() callbacks
to execute. The callback can still be queued when module text is freed.
The rcu_barrier() is needed to flush them.

Many modules (including fuse itself) already call rcu_barrier() on exit
for exactly this reason. Documentation/RCU/rcubarrier.rst also explicitly
states that synchronize_rcu() does not wait for callbacks and cannot
replace rcu_barrier().


Thanks,
Baokun

Re: [PATCH] cuse: wait for pending RCU callbacks on module exit

[Miklos Szeredi]

On Tue, 18 Aug 2026 at 10:00, Baokun Li <libaokun@linux.alibaba.com> wrote:

> Many modules (including fuse itself) already call rcu_barrier() on exit
> for exactly this reason. Documentation/RCU/rcubarrier.rst also explicitly
> states that synchronize_rcu() does not wait for callbacks and cannot
> replace rcu_barrier().

Got it.

Applied, thanks.

Miklos