linux.git/fs/fuse/dev.c, branch v5.1-rc2

fuse: clean up aborted

2019-02-13T12:15:14+00:00

The only caller that needs fc->aborted set is fuse_conn_abort_write().
Setting fc->aborted is now racy (fuse_abort_conn() may already be in
progress or finished) but there's no reason to care.

Signed-off-by: Miklos Szeredi

fuse: Protect ff->reserved_req via corresponding fi->lock

2019-02-13T12:15:14+00:00

This is rather natural action after previous patches, and it just decreases
load of fc->lock.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Verify userspace asks to requeue interrupt that we really sent

2019-02-13T12:15:13+00:00

When queue_interrupt() is called from fuse_dev_do_write(), it came from
userspace directly. Userspace may pass any request id, even the request's
we have not interrupted (or even background's request). This patch adds
sanity check to make kernel safe against that.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Do some refactoring in fuse_dev_do_write()

2019-02-13T12:15:13+00:00

This is needed for next patch.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Wake up req->waitq of only if not background

2019-02-13T12:15:13+00:00

Currently, we wait on req->waitq in request_wait_answer() function only,
and it's never used for background requests.  Since wake_up() is not a
light-weight macros, instead of this, it unfolds in really called function,
which makes locking operations taking some cpu cycles, let's avoid its call
for the case we definitely know it's completely useless.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Optimize request_end() by not taking fiq->waitq.lock

2019-02-13T12:15:13+00:00

We take global fiq->waitq.lock every time, when we are in this function,
but interrupted requests are just small subset of all requests. This patch
optimizes request_end() and makes it to take the lock when it's really
needed.

queue_interrupt() needs small change for that. After req is linked to
interrupt list, we do smp_mb() and check for FR_FINISHED again. In case of
FR_FINISHED bit has appeared, we remove req and leave the function:

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Kill fasync only if interrupt is queued in queue_interrupt()

2019-02-13T12:15:13+00:00

We should sent signal only in case of interrupt is really queued.  Not a
real problem, but this makes the code clearer and intuitive.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: Remove stale comment in end_requests()

2019-02-13T12:15:12+00:00

Function end_requests() does not take fc->lock.

Signed-off-by: Kirill Tkhai 
Signed-off-by: Miklos Szeredi

fuse: call pipe_buf_release() under pipe lock

2019-01-16T09:27:59+00:00

Some of the pipe_buf_release() handlers seem to assume that the pipe is
locked - in particular, anon_pipe_buf_release() accesses pipe->tmp_page
without taking any extra locks. From a glance through the callers of
pipe_buf_release(), it looks like FUSE is the only one that calls
pipe_buf_release() without having the pipe locked.

This bug should only lead to a memory leak, nothing terrible.

Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn 
Signed-off-by: Miklos Szeredi

fuse: handle zero sized retrieve correctly

2019-01-16T09:27:59+00:00

Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.

Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Fixes: b2430d7567a3 ("fuse: add per-page descriptor  to fuse_req")
Cc:  # v3.9
Signed-off-by: Miklos Szeredi