linux-stable.git/fs/fuse, branch v4.1.35

fuse: direct-io: don't dirty ITER_BVEC pages

2016-10-02T16:50:39+00:00

[ Upstream commit 8fba54aebbdf1f999738121922e74bf796ad60ee ]

When reading from a loop device backed by a fuse file it deadlocks on
lock_page().

This is because the page is already locked by the read() operation done on
the loop device.  In this case we don't want to either lock the page or
dirty it.

So do what fs/direct-io.c does: only dirty the page for ITER_IOVEC vectors.

Reported-by: Sheng Yang 
Fixes: aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
Signed-off-by: Miklos Szeredi 
Cc:  # v4.1+
Reviewed-by: Sheng Yang 
Reviewed-by: Ashish Samant 
Tested-by: Sheng Yang 
Tested-by: Ashish Samant 
Signed-off-by: Sasha Levin

fuse: fix wrong assignment of ->flags in fuse_send_init()

2016-08-20T03:07:58+00:00

[ Upstream commit 9446385f05c9af25fed53dbed3cc75763730be52 ]

FUSE_HAS_IOCTL_DIR should be assigned to ->flags, it may be a typo.

Signed-off-by: Wei Fang 
Signed-off-by: Miklos Szeredi 
Fixes: 69fe05c90ed5 ("fuse: add missing INIT flags")
Cc: 
Signed-off-by: Sasha Levin

fuse: fuse_flush must check mapping->flags for errors

2016-08-20T03:07:58+00:00

[ Upstream commit 9ebce595f63a407c5cec98f98f9da8459b73740a ]

fuse_flush() calls write_inode_now() that triggers writeback, but actual
writeback will happen later, on fuse_sync_writes(). If an error happens,
fuse_writepage_end() will set error bit in mapping->flags. So, we have to
check mapping->flags after fuse_sync_writes().

Signed-off-by: Maxim Patlasov 
Signed-off-by: Miklos Szeredi 
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Cc:  # v3.15+
Signed-off-by: Sasha Levin

fuse: fsync() did not return IO errors

2016-08-20T03:07:58+00:00

[ Upstream commit ac7f052b9e1534c8248f814b6f0068ad8d4a06d2 ]

Due to implementation of fuse writeback filemap_write_and_wait_range() does
not catch errors. We have to do this directly after fuse_sync_writes()

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: Maxim Patlasov 
Signed-off-by: Miklos Szeredi 
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Cc:  # v3.15+
Signed-off-by: Sasha Levin

fuse: Add reference counting for fuse_io_priv

2016-04-18T12:50:57+00:00

[ Upstream commit 744742d692e37ad5c20630e57d526c8f2e2fe3c9 ]

The 'reqs' member of fuse_io_priv serves two purposes. First is to track
the number of oustanding async requests to the server and to signal that
the io request is completed. The second is to be a reference count on the
structure to know when it can be freed.

For sync io requests these purposes can be at odds.  fuse_direct_IO() wants
to block until the request is done, and since the signal is sent when
'reqs' reaches 0 it cannot keep a reference to the object. Yet it needs to
use the object after the userspace server has completed processing
requests. This leads to some handshaking and special casing that it
needlessly complicated and responsible for at least one race condition.

It's much cleaner and safer to maintain a separate reference count for the
object lifecycle and to let 'reqs' just be a count of outstanding requests
to the userspace server. Then we can know for sure when it is safe to free
the object without any handshaking or special cases.

The catch here is that most of the time these objects are stack allocated
and should not be freed. Initializing these objects with a single reference
that is never released prevents accidental attempts to free the objects.

Fixes: 9d5722b7777e ("fuse: handle synchronous iocbs internally")
Cc: stable@vger.kernel.org # v4.1+
Signed-off-by: Seth Forshee 
Signed-off-by: Miklos Szeredi 
Signed-off-by: Sasha Levin

fuse: do not use iocb after it may have been freed

2016-04-18T12:50:56+00:00

[ Upstream commit 7cabc61e01a0a8b663bd2b4c982aa53048218734 ]

There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an
iocb that could have been freed if async io has already completed.  The fix
in this case is simple and obvious: cache the result before starting io.

It was discovered by KASan:

kernel: ==================================================================
kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390

Signed-off-by: Robert Doebbelin 
Signed-off-by: Miklos Szeredi 
Fixes: bcba24ccdc82 ("fuse: enable asynchronous processing direct IO")
Cc:  # 3.10+
Signed-off-by: Sasha Levin

fuse: break infinite loop in fuse_fill_write_pages()

2016-04-13T21:14:29+00:00

[ Upstream commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 ]

I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.

Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.

A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.

Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.

Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.

Cc: Andrew Morton 
Cc: Maxim Patlasov 
Cc: Konstantin Khlebnikov 
Signed-off-by: Roman Gushchin 
Signed-off-by: Miklos Szeredi 
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Cc: 
Signed-off-by: Sasha Levin

fuse: initialize fc->release before calling it

2015-08-03T16:29:14+00:00

commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.

fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.

[Jeremiah Mahler : assign fc->release after calling
fuse_conn_init(fc) instead of before.]

Signed-off-by: Miklos Szeredi 
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Signed-off-by: Greg Kroah-Hartman

sysfs: Create mountpoints with sysfs_create_mount_point

2015-07-21T17:10:01+00:00

commit f9bb48825a6b5d02f4cabcc78967c75db903dcdc upstream.

This allows for better documentation in the code and
it allows for a simpler and fully correct version of
fs_fully_visible to be written.

The mount points converted and their filesystems are:
/sys/hypervisor/s390/       s390_hypfs
/sys/kernel/config/         configfs
/sys/kernel/debug/          debugfs
/sys/firmware/efi/efivars/  efivarfs
/sys/fs/fuse/connections/   fusectl
/sys/fs/pstore/             pstore
/sys/kernel/tracing/        tracefs
/sys/fs/cgroup/             cgroup
/sys/kernel/security/       securityfs
/sys/fs/selinux/            selinuxfs
/sys/fs/smackfs/            smackfs

Acked-by: Greg Kroah-Hartman 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15T19:06:57+00:00

that's the bulk of filesystem drivers dealing with inodes of their own

Signed-off-by: David Howells 
Signed-off-by: Al Viro