CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on open OTRUNC DAX failure
fuseopen() takes filemapinvalidatelock() for a DAX truncate (daxtruncate = true) and releases it before the outinodeunlock label. But when fusedaxbreaklayouts() fails, the goto outinodeunlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock.
fusedaxbreaklayouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain:
open("file", ORDWR | OTRUNC) └─ fuseopen() ├─ filemapinvalidatelock() # daxtruncate └─ fusedaxbreaklayouts() └─ daxbreaklayout() └─ waitpageidle() # TASKINTERRUPTIBLE └─ fusewaitdaxpage() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto outinodeunlock # <- lock leaked
Fix this by moving filemapinvalidateunlock() below the label so that all error paths release the lock, and rename the label to outunlock as it now covers more than just the inode lock.
Event History
Frequently Asked Questions
What conditions are required to trigger the lock leak?
The affected path requires a FUSE file using DAX to be opened with O_RDWR and O_TRUNC. During that open, fuse_dax_break_layouts() must fail, such as when a signal interrupts its wait for busy DAX pages to drain and it returns -ERESTARTSYS.
What is the operational impact after the failure occurs?
The filemap invalidate rwsem remains locked. Later page faults or truncate operations on the same file can stall while waiting on the stale lock.
How can an administrator recognize that this issue may have occurred?
A likely indicator is that a FUSE DAX file has a stalled fault or truncate after an interrupted O_TRUNC open operation. The triggering failure involves a signal interrupting the wait for busy DAX pages to become idle.
What does the available fix change?
The fix moves filemap_invalidate_unlock() below the shared error label, ensuring the invalidate lock is released on error paths including failure from fuse_dax_break_layouts().