Allow for raw marshalling of BackingIds by Popax21 · Pull Request #660 · cberner/fuser

Popax21 · 2026-02-25T14:21:45Z

Adds methods to convert BackingIds from/to their raw backing_id values, which allows for marshalling of backing file references across process boundaries.

Currently, the Linux kernel still requires CAP_SYS_ADMIN to use FUSE passthrough.
Since this is a highly privileged capability, FUSE filesystem drivers may wish to move this part of their FS into a privileged host process, while continuing to run the rest of the FS at a lower privilege level.
However, this requires the ability to move a BackingId reference across process boundaries; this PR adds two methods, BackingId::into_raw() and ReplyOpen::wrap_backing(), to convert the safe Rust wrapper to/from the underlying raw backing_id value respectively, which the user may then e.g. send across process boundaries.

ReplyOpen::wrap_backing() is marked as unsafe, even though as far as I can tell misuse of this method does not result in anything else than subsequent operations on the BackingId erroring out.
However just to be safe / clearly communicate the "raw-ness" of the operation I have still decided to mark it as unsafe anyway.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b3e1c3b9f2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-02-25T14:24:55Z

src/passthrough.rs

+    /// [`ReplyOpen::wrap_backing()`](crate::ReplyOpen::wrap_backing).
+    pub fn into_raw(self) -> u32 {
+        let id = self.backing_id;
+        std::mem::forget(self);


Release weak channel ref before forgetting BackingId

BackingId::into_raw() calls mem::forget(self), which suppresses Weak<DevFuse> destruction as well as Drop; this leaks the weak ref count on the channel and can keep each session’s Arc allocation alive indefinitely after unmount when into_raw() is used. In long-running processes that create/destroy sessions and marshal backing IDs, this becomes a real memory/resource-retention leak.

Useful? React with 👍 / 👎.

Resolved in latest push

Why do we need this explicit drop() and forget()?

This is still here

cberner

Please add a test for this feature, that tests it works in a multi process setup like you described.

Also, I don't think unsafe is appropriate here. Those methods don't look like they can cause memory safety issues.

cberner · 2026-02-27T04:56:09Z

src/passthrough.rs

+    /// [`ReplyOpen::wrap_backing()`](crate::ReplyOpen::wrap_backing).
+    pub fn into_raw(self) -> u32 {
+        let id = self.backing_id;
+        std::mem::forget(self);


Why do we need this explicit drop() and forget()?

Popax21 · 2026-02-27T23:28:51Z

Please add a test for this feature, that tests it works in a multi process setup like you described.

Done; over the course of programming the example, I have encountered some other minor issues that I have decided to clean up as I went along (see the two respective comments for details).

Also, I don't think unsafe is appropriate here. Those methods don't look like they can cause memory safety issues.

As explained in the PR description this is mostly a precautionary measure, following the precedent set by std::os::fd::FromRawFd / Rust's IO safety concept. However, I can remove the unsafe specifier if you still think that doing so would be the right call.

Popax21 · 2026-02-28T18:40:52Z

Fixed the rustc lint build failure (seems like it only appears on nightly, and I ran my pre-commit checks on stable; oops...)

Popax21 · 2026-03-01T01:46:12Z

Ok, lints are just sending us in circles now; seems like we either get a unused-parens lint, or a break-with-label-and-loop lint. Either rust-lang/rust#137414 regressed, or the CI's rustc doesn't include the fix for that issue yet. Should I try to refactor the code to avoid the snippet in question, or should I just #[allow(...)] one of the lints?

cberner · 2026-03-01T03:30:08Z

I wondered if we'd run into issues with nightly rustfmt regressions. I'll see if I can revert it to stable. I believe it's only needed for one format option, that's nice to have but not really required

cberner · 2026-03-01T04:41:48Z

I merged #661

Can you try rebasing on master?

Adds methods to convert BackingIds from/to their raw `backing_id` values, which allows for marshalling of backing file references across process boundaries.

The kernel rejects all `FOPEN_PASSTHROUGH` replies for an inode that's already open in passthrough mode if the given `backing_id` does not match the current `backing_id`. Clarify this in the relevant method documentation.

Expose the underlying filesystem reference & the `run` method.

Popax21 · 2026-03-01T16:13:17Z

I merged #661

Can you try rebasing on master?

Done; also removed the extra parenthesis again since hopefully that lint should no longer trigger a false positive.

EDIT: since the lint still appeared I've just refactored the offending line away now.

cberner

This feature still needs a test that runs as part of CI. It should test that it works as expected: backing ids can be passed from a privileged process to an unprivileged process and used there

cberner · 2026-03-01T22:50:00Z

src/passthrough.rs

+    /// [`ReplyOpen::wrap_backing()`](crate::ReplyOpen::wrap_backing).
+    pub fn into_raw(self) -> u32 {
+        let id = self.backing_id;
+        std::mem::forget(self);


This is still here

cberner · 2026-03-01T22:52:32Z

src/session.rs

+    /// The underlying [Filesystem]
+    pub fn filesystem(&self) -> &FS {
+        &self.filesystem
+    }


I'd like to avoid this method, unless there's a really strong reason to have it. Why do you need it?

cberner · 2026-03-01T22:52:54Z

src/session.rs

 #[derive(Debug)]
 pub struct Session<FS: Filesystem> {
-    /// Filesystem operation implementations. None after `destroy` called.
-    pub(crate) filesystem: FilesystemHolder<FS>,


Why did you remove the FilesystemHolder?

cberner · 2026-03-01T22:53:59Z

src/lib.rs

    mountpoint: P,
    options: &Config,
 ) -> io::Result<()> {
-    check_option_conflicts(options)?;


Please submit this in a separate PR, since it isn't related to the BackingId feature, as far as I can tell

chatgpt-codex-connector bot reviewed Feb 25, 2026

View reviewed changes

Popax21 force-pushed the master branch from b3e1c3b to 103038f Compare February 25, 2026 14:28

Popax21 temporarily deployed to macstadium February 26, 2026 04:39 — with GitHub Actions Inactive

cberner requested changes Feb 27, 2026

View reviewed changes

Popax21 force-pushed the master branch from 103038f to 5580ae8 Compare February 27, 2026 23:25

Popax21 requested a review from cberner February 27, 2026 23:29

Popax21 requested a deployment to macstadium February 28, 2026 17:19 — with GitHub Actions Waiting

Popax21 force-pushed the master branch from 5580ae8 to ac8fe18 Compare February 28, 2026 18:39

Popax21 requested a deployment to macstadium March 1, 2026 00:39 — with GitHub Actions Waiting

Popax21 added 3 commits March 1, 2026 17:11

Allow for raw marshalling of BackingIds

b2277bc

Adds methods to convert BackingIds from/to their raw `backing_id` values, which allows for marshalling of backing file references across process boundaries.

Clarify BackingId caching requirement

9610a2f

The kernel rejects all `FOPEN_PASSTHROUGH` replies for an inode that's already open in passthrough mode if the given `backing_id` does not match the current `backing_id`. Clarify this in the relevant method documentation.

Minor session improvements

bb3a11d

Expose the underlying filesystem reference & the `run` method.

Popax21 force-pushed the master branch from ac8fe18 to ca4694a Compare March 1, 2026 16:12

Popax21 requested a deployment to macstadium March 1, 2026 17:16 — with GitHub Actions Waiting

Add forking passthrough example

eda5e35

Popax21 force-pushed the master branch from ca4694a to eda5e35 Compare March 1, 2026 19:29

Popax21 deployed to macstadium March 1, 2026 19:58 — with GitHub Actions Active

cberner requested changes Mar 1, 2026

View reviewed changes

Conversation

Popax21 commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cberner left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Popax21 commented Feb 27, 2026

Uh oh!

Popax21 commented Feb 28, 2026

Uh oh!

Popax21 commented Mar 1, 2026

Uh oh!

cberner commented Mar 1, 2026

Uh oh!

cberner commented Mar 1, 2026

Uh oh!

Popax21 commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cberner left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Popax21 commented Feb 25, 2026 •

edited

Loading

Popax21 commented Mar 1, 2026 •

edited

Loading