fs: buffer error in directory reads

Previously, if a DirStream.Next() call would return error, we would
return the buffered data as well as the errno code in the same
request.

This would confuse the kernel, who interprets this as an invalid
response, returning syscall.EIO to the caller.

To fix this, also buffer the errno as overflow entry in the fileEntry
struct. When we encounter an error, return thus far read entries with
success. The following read contains just the error.

For testing this properly, loopbackDirStream (which reads directory
contents) must also buffer error returns.

Change-Id: Ideb8ea6f540de9189a0f366efca0db2205e5dec3

fs/bridge.go

@@ -33,6 +33,8 @@ type fileEntry struct {
 	dirStream     DirStream
 	hasOverflow   bool
 	overflow      fuse.DirEntry
+	overflowErrno syscall.Errno
+
 	// dirOffset is the current location in the directory (see `telldir(3)`).
 	// The value is equivalent to `d_off` (see `getdents(2)`) of the last
 	// directory entry sent to the kernel so far.
@@ -999,18 +1001,31 @@ func (b *rawBridge) ReadDir(cancel <-chan struct{}, input *fuse.ReadIn, out *fus
 	}
 
 	if f.hasOverflow {
+		if f.overflowErrno != 0 {
+			return errnoToStatus(f.overflowErrno)
+		}
+
+		f.hasOverflow = false
 		// always succeeds.
 		out.AddDirEntry(f.overflow)
-		f.hasOverflow = false
 		f.dirOffset++
 	}
 
+	first := true
 	for f.dirStream.HasNext() {
 		e, errno := f.dirStream.Next()
 
 		if errno != 0 {
+			if first {
 				return errnoToStatus(errno)
+			} else {
+				f.hasOverflow = true
+				f.overflowErrno = errno
+				return fuse.OK
 			}
+		}
+
+		first = false
 		if !out.AddDirEntry(e) {
 			f.overflow = e
 			f.hasOverflow = true
@@ -1036,20 +1051,30 @@ func (b *rawBridge) ReadDirPlus(cancel <-chan struct{}, input *fuse.ReadIn, out
 	}
 
 	ctx := &fuse.Context{Caller: input.Caller, Cancel: cancel}
+
+	first := true
 	for f.dirStream.HasNext() || f.hasOverflow {
 		var e fuse.DirEntry
 		var errno syscall.Errno
 
 		if f.hasOverflow {
 			e = f.overflow
+			errno = f.overflowErrno
 			f.hasOverflow = false
 		} else {
 			e, errno = f.dirStream.Next()
 		}
 
 		if errno != 0 {
+			if first {
 				return errnoToStatus(errno)
+			} else {
+				f.overflowErrno = errno
+				f.hasOverflow = true
+				return fuse.OK
+			}
 		}
+		first = false
 
 		entryOut := out.AddDirLookupEntry(e)
 		if entryOut == nil {

fs/dir_test.go

+// Copyright 2023 the Go-FUSE Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package fs
+
+import (
+	"context"
+	"fmt"
+	"syscall"
+	"testing"
+
+	"github.com/hanwen/go-fuse/v2/fuse"
+)
+
+type dirStreamErrorNode struct {
+	Inode
+}
+
+var _ = (NodeReaddirer)((*dirStreamErrorNode)(nil))
+
+func (n *dirStreamErrorNode) Readdir(ctx context.Context) (DirStream, syscall.Errno) {
+	return &errDirStream{}, 0
+}
+
+type errDirStream struct {
+	num int
+}
+
+func (ds *errDirStream) HasNext() bool {
+	return ds.num < 2
+}
+
+func (ds *errDirStream) Next() (fuse.DirEntry, syscall.Errno) {
+	ds.num++
+	if ds.num == 1 {
+		return fuse.DirEntry{
+			Mode: fuse.S_IFREG,
+			Name: "first",
+			Ino:  2,
+		}, 0
+	}
+	if ds.num == 2 {
+		return fuse.DirEntry{
+			Mode: fuse.S_IFREG,
+			Name: "last",
+			Ino:  3,
+		}, syscall.EKEYEXPIRED
+	}
+
+	panic("boom")
+}
+
+func (ds *errDirStream) Close() {
+
+}
+
+func TestDirStreamError(t *testing.T) {
+	for _, disableReaddirplus := range []bool{false, true} {
+		t.Run(fmt.Sprintf("disableReaddirplus=%v", disableReaddirplus),
+			func(t *testing.T) {
+				root := &dirStreamErrorNode{}
+				opts := Options{}
+				opts.DisableReadDirPlus = disableReaddirplus
+
+				mnt, _ := testMount(t, root, &opts)
+
+				ds, errno := NewLoopbackDirStream(mnt)
+				if errno != 0 {
+					t.Fatalf("NewLoopbackDirStream: %v", errno)
+				}
+				defer ds.Close()
+
+				if e, errno := ds.Next(); errno != 0 {
+					t.Errorf("ds.Next: %v", errno)
+				} else if e.Name != "first" {
+					t.Errorf("got %q want 'first'", e.Name)
+				}
+
+				if _, errno := ds.Next(); errno != syscall.EKEYEXPIRED {
+					t.Errorf("got errno %v, want EKEYEXPIRED", errno)
+				}
+			})
+	}
+}

fs/dirstream_linux.go

@@ -15,6 +15,7 @@ import (
 type loopbackDirStream struct {
 	buf       []byte
 	todo      []byte
+	todoErrno syscall.Errno
 
 	// Protects fd so we can guard against double close
 	mu sync.Mutex
@@ -52,7 +53,7 @@ func (ds *loopbackDirStream) Close() {
 func (ds *loopbackDirStream) HasNext() bool {
 	ds.mu.Lock()
 	defer ds.mu.Unlock()
-	return len(ds.todo) > 0
+	return len(ds.todo) > 0 || ds.todoErrno != 0
 }
 
 // Like syscall.Dirent, but without the [256]byte name.
@@ -68,6 +69,10 @@ func (ds *loopbackDirStream) Next() (fuse.DirEntry, syscall.Errno) {
 	ds.mu.Lock()
 	defer ds.mu.Unlock()
 
+	if ds.todoErrno != 0 {
+		return fuse.DirEntry{}, ds.todoErrno
+	}
+
 	// We can't use syscall.Dirent here, because it declares a
 	// [256]byte name, which may run beyond the end of ds.todo.
 	// when that happens in the race detector, it causes a panic
@@ -99,9 +104,10 @@ func (ds *loopbackDirStream) load() syscall.Errno {
 	}
 
 	n, err := syscall.Getdents(ds.fd, ds.buf)
-	if err != nil {
-		return ToErrno(err)
+	if n < 0 {
+		n = 0
 	}
 	ds.todo = ds.buf[:n]
+	ds.todoErrno = ToErrno(err)
 	return OK
 }