Skip to content

L
linux
Switch branch/tag
  1. 22 Oct, 2021 4 commits
    • Peng Hao's avatar
      fuse: use kmap_local_page() · 5fe0fc9f
      Peng Hao authored 
      Due to the introduction of kmap_local_*, the storage of slots used for
short-term mapping has changed from per-CPU to per-thread.  kmap_atomic()
disable preemption, while kmap_local_*() only disable migration.

There is no need to disable preemption in several kamp_atomic places used
in fuse.

Link: https://lwn.net/Articles/836144/Signed-off-by: default avatarPeng Hao <flyingpeng@tencent.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      5fe0fc9f
    • Miklos Szeredi's avatar
      fuse: annotate lock in fuse_reverse_inval_entry() · bda9a719
      Miklos Szeredi authored 
      Add missing inode lock annotatation; found by syzbot.

Reported-and-tested-by: syzbot+9f747458f5990eaa8d43@syzkaller.appspotmail.com
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      bda9a719
    • Miklos Szeredi's avatar
      fuse: write inode in fuse_vma_close() instead of fuse_release() · 36ea2337
      Miklos Szeredi authored 
      Fuse ->release() is otherwise asynchronous for the reason that it can
happen in contexts unrelated to close/munmap.

Inode is already written back from fuse_flush().  Add it to
fuse_vma_close() as well to make sure inode dirtying from mmaps also get
written out before the file is released.

Also add error handling.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      36ea2337
    • Miklos Szeredi's avatar
      fuse: make sure reclaim doesn't write the inode · 5c791fe1
      Miklos Szeredi authored 
      In writeback cache mode mtime/ctime updates are cached, and flushed to the
server using the ->write_inode() callback.

Closing the file will result in a dirty inode being immediately written,
but in other cases the inode can remain dirty after all references are
dropped.  This result in the inode being written back from reclaim, which
can deadlock on a regular allocation while the request is being served.

The usual mechanisms (GFP_NOFS/PF_MEMALLOC*) don't work for FUSE, because
serving a request involves unrelated userspace process(es).

Instead do the same as for dirty pages: make sure the inode is written
before the last reference is gone.

 - fallocate(2)/copy_file_range(2): these call file_update_time() or
   file_modified(), so flush the inode before returning from the call

 - unlink(2), link(2) and rename(2): these call fuse_update_ctime(), so
   flush the ctime directly from this helper
Reported-by: default avatarchenguanyou <chenguanyou@xiaomi.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      5c791fe1
  3. 21 Oct, 2021 5 commits
    • Miklos Szeredi's avatar
      fuse: clean up error exits in fuse_fill_super() · 964d32e5
      Miklos Szeredi authored 
      Instead of "goto err", return error directly, since there's no error
cleanup to do now.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      964d32e5
    • Miklos Szeredi's avatar
      fuse: always initialize sb->s_fs_info · 80019f11
      Miklos Szeredi authored 
      Syzkaller reports a null pointer dereference in fuse_test_super() that is
caused by sb->s_fs_info being NULL.

This is due to the fact that fuse_fill_super() is initializing s_fs_info,
which is too late, it's already on the fs_supers list.  The initialization
needs to be done in sget_fc() with the sb_lock held.

Move allocation of fuse_mount and fuse_conn from fuse_fill_super() into
fuse_get_tree().

After this ->kill_sb() will always be called with non-NULL ->s_fs_info,
hence fuse_mount_destroy() can drop the test for non-NULL "fm".

Reported-by: syzbot+74a15f02ccb51f398601@syzkaller.appspotmail.com
Fixes: 5d5b74aa ("fuse: allow sharing existing sb")
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      80019f11
    • Miklos Szeredi's avatar
      fuse: clean up fuse_mount destruction · c191cd07
      Miklos Szeredi authored 
      1. call fuse_mount_destroy() for open coded variants

2. before deactivate_locked_super() don't need fuse_mount destruction since
that will now be done (if ->s_fs_info is not cleared)

3. rearrange fuse_mount setup in fuse_get_tree_submount() so that the
regular pattern can be used
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      c191cd07
    • Miklos Szeredi's avatar
      fuse: get rid of fuse_put_super() · a27c061a
      Miklos Szeredi authored 
      The ->put_super callback is called from generic_shutdown_super() in case of
a fully initialized sb.  This is called from kill_***_super(), which is
called from ->kill_sb instances.

Fuse uses ->put_super to destroy the fs specific fuse_mount and drop the
reference to the fuse_conn, while it does the same on each error case
during sb setup.

This patch moves the destruction from fuse_put_super() to
fuse_mount_destroy(), called at the end of all ->kill_sb instances.  A
follup patch will clean up the error paths.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      a27c061a
    • Miklos Szeredi's avatar
      fuse: check s_root when destroying sb · d534d31d
      Miklos Szeredi authored 
      Checking "fm" works because currently sb->s_fs_info is cleared on error
paths; however, sb->s_root is what generic_shutdown_super() checks to
determine whether the sb was fully initialized or not.

This change will allow cleanup of sb setup error paths.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      d534d31d
  5. 18 Oct, 2021 17 commits
  7. 17 Oct, 2021 3 commits
  9. 16 Oct, 2021 11 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7