[PATCH] fuse: refuse FUSE_NOTIFY_STORE for DAX inodes

[Joas Antonio dos Santos]

Since commit 2fbe4586cff3 ("fuse: add support for opening dax device as
backing"), a regular file is marked S_DAX whenever the server sets
FUSE_ATTR_DAX in the attributes. This does not depend on any INIT flag,
so any FUSE server can do it, including an unprivileged one.

fuse_notify_store() does not check for this. It adds ordinary page cache
folios to the mapping of such an inode with filemap_grab_folio(), while
the DAX code expects that mapping to hold only DAX entries. When the
inode is evicted, fuse_evict_inode() calls dax_break_layout_final(), and
dax_layout_busy_page_range() hits WARN_ON_ONCE(!xa_is_value(entry)):

  WARNING: fs/dax.c:825 at dax_layout_busy_page_range+0x394/0x4dc
  CPU: 0 UID: 65534 PID: 93 Comm: fusedax
  Call trace:
   dax_layout_busy_page_range+0x394/0x4dc (P)
   dax_break_layout_final+0x104/0x278
   fuse_evict_inode+0x2cc/0x57c
   evict+0x2b4/0x748
   iput.part.0+0x51c/0x964
   ...
   fuse_kill_sb_anon+0x170/0x268
   deactivate_locked_super+0x98/0x11c

With panic_on_warn set, this lets an unprivileged FUSE server panic the
machine.

DAX mappings do not hold page cache folios, so storing data into one has
no use. Return -EINVAL, as is already done for files that are not
regular. This also covers virtiofs DAX inodes.

Reproduced on current mainline (arm64, CONFIG_FS_DAX=y) with a FUSE
server running as uid 65534 in a new user and mount namespace, answering
INIT with no flags, LOOKUP with FUSE_ATTR_DAX on a regular file, then
sending FUSE_NOTIFY_STORE for it and unmounting. Before: the WARN above,
and a panic with panic_on_warn=1. After: FUSE_NOTIFY_STORE fails with
EINVAL and nothing is logged. FUSE_NOTIFY_STORE on a regular inode
without FUSE_ATTR_DAX still works.

Found by code review of the DAX backing changes and confirmed with the
reproducer above.

Fixes: 2fbe4586cff3 ("fuse: add support for opening dax device as backing")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
---
Tool-use note: the code review that found this and the reproducer were
prepared with help from an LLM-based assistant; I reviewed the change
and built and ran the tests myself. Reproducer available on request.

 fs/fuse/notify.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/fuse/notify.c b/fs/fuse/notify.c
index 984e4945e..938440474 100644
--- a/fs/fuse/notify.c
+++ b/fs/fuse/notify.c
@@ -167,6 +167,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
 		err = -EINVAL;
 		goto out_iput;
 	}
+	/* DAX mappings do not hold page cache folios */
+	if (IS_DAX(inode)) {
+		err = -EINVAL;
+		goto out_iput;
+	}
 
 	mapping = inode->i_mapping;
 	file_size = i_size_read(inode);
-- 
2.43.0