Re: [PATCH] fuse: reject fuse_notify() pagecache ops on directories

[Miklos Szeredi]

On Tue, 19 May 2026 at 16:00, Jann Horn <jannh@xxxxxxxxxx> wrote:
>
> The operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow the
> FUSE daemon to actively write/read pagecache contents.
>
> For directories with FOPEN_CACHE_DIR, the pagecache is used as
> kernel-internal cache storage, and userspace is not supposed to have
> direct access to this cache - in particular, fuse_parse_cache() will hit
> WARN_ON() if the cache contains bogus data.
>
> Reject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE on directories with
> -EINVAL.

Good catch.

Shouldn't this reject !S_ISREG()?  Symlinks also use the page cache
and could break if overwritten by arbitrary data.

Thanks,
Miklos