Re: [PATCH v3 1/3] fuse: don't clear folio uptodate on writethrough errors

On Wed, 8 Jul 2026 at 00:05, Joanne Koong <[email protected]> wrote:
>
> In the writethrough path (fuse_send_write_pages()), if the write to the
> server failed or was a short write, the uptodate flag on the folios are
> cleared.
>
> As explained by Matthew in [1], this is dangerous because the folio may
> be mapped into userspace. The mm code has the invariant that a
> non-uptodate folio must never be visible to userspace (to avoid
> potentially leaking confidental information to userspace) and has checks
> in place for this that if violated can bring down the whole machine.
>
> Practically speaking, the effect of this change for the fuse
> writethrough error path is that if an application does a write and then
> the server fails to persist the data or only services a short write, the
> page cache folio keeps the data the application wrote instead of being
> reverted to the server's contents on the next read. The failure is still
> reported to the application synchronously through the short count /
> error return of the write() syscall. Folios that were only partially
> written are unaffected since they were never marked uptodate in the
> first place (fuse_fill_write_page() only marks a folio as uptodate if
> the whole folio was written to).
>
> [1] https://lore.kernel.org/linux-fsdevel/[email protected]/
>
> Suggested-by: Matthew Wilcox <[email protected]>
> Reviewed-by: Darrick J. Wong <[email protected]>
> Signed-off-by: Joanne Koong <[email protected]>

Acked-by: Miklos Szeredi <[email protected]>