Port the Modal patches onto upstream v0.16.0

[dflemstr]

Summary

The real fuser upgrade, to be tested independently of the minimal backport in #9.

This rebases the Modal-specific work from fs/pin-bcff57c onto upstream v0.16.0, the first upstream release carrying the fix for GHSA-cvmj-47v9-35m9. The base branch here is upstream v0.16.0 unchanged, so the diff is exactly the port and nothing else.

Unlike the backport, this also clears Dependabot alert modal-labs/modal#149 on its own: that alert matches the crate version against < 0.16.0, and the version here becomes 0.16.0.

v0.16.0 is the target rather than v0.17.0 or v0.18.0 because it is the smallest step that carries the fix — 68 upstream commits from our current base, against 305 and 333 respectively. Given that the previous upgrade attempt was reverted on suspicion of volume reload breakage, the smallest viable delta seemed right.

Carried forward

• FilesystemSession, holding the filesystem impl plus protocol state, extracted from Session so dispatch is transport-agnostic
• Request::new and Request::dispatch made public, taking the reply sender as a parameter rather than reaching into a Session's channel
• ReplySender implemented for Arc<dyn ReplySender>
• FUSE request buffers lowered to the negotiated max_write, with the resize applied before the aligned sub-buffer is recomputed

Dropped as redundant

Both were fixed upstream:

• Making SessionACL public. Upstream also derives Default with Owner as the default, so upstream's definition is kept.
• The pre-abi-7-16 access control fallback and the pre-abi-7-9 getattr fallback, which upstream deleted outright.

Adapted to upstream changes

Four places needed judgement rather than mechanical replay:

• Session::from_fd is new in 0.16 and constructed Session with the flat fields; it now builds a FilesystemSession.
• Drop ordering. Upstream now stores the mountpoint alongside the mount and unmounts inside Session::drop's body. Since field drops run after the body, that unmount would have preceded FilesystemSession's drop and therefore the filesystem's destroy hook — inverting the previous order. Session::drop now runs destroy itself, so teardown still happens while the mount is in place. This is the change most worth a second pair of eyes, since reordering teardown is the kind of thing that could plausibly explain the earlier volume reload symptoms.
• PollHandle, new in 0.16, was wired to the concrete ChannelSender, which a transport-agnostic dispatch has no way to supply. Notifier now holds an Arc<dyn ReplySender> — which is what the Arc<dyn ReplySender> impl above exists for. It only ever needed send, so this is a narrowing rather than a rewrite, and it means notifications now work on any transport.
• The init hook's error is propagated with Errno::from_i32, as upstream does. The fs/pin-bcff57c code being replaced returned EIO unconditionally, discarding the errno the filesystem reported; that looks like an oversight from adapting to the tuple error type rather than something intentional.

Test plan

• cargo build against libfuse3 3.17.4
• cargo test — 53 tests pass
• Consumer crates in modal-labs/modal build against this branch
• Volume reload exercised on a worker, the symptom that caused modal#27426
• virtiofs path exercised, since FilesystemSession and Notifier both changed shape

Made with Cursor