Commit 5a18ec17 authored by Miklos Szeredi's avatar Miklos Szeredi

fuse: fix hang of single threaded fuseblk filesystem

Single threaded NTFS-3G could get stuck if a delayed RELEASE reply
triggered a DESTROY request via path_put().

Fix this by

 a) making RELEASE requests synchronous, whenever possible, on fuseblk
 filesystems

 b) if not possible (triggered by an asynchronous read/write) then do
 the path_put() in a separate thread with schedule_work().
Reported-by: default avatarOliver Neukum <oneukum@suse.de>
Cc: stable@kernel.org
Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
parent 4662db44
...@@ -86,18 +86,52 @@ struct fuse_file *fuse_file_get(struct fuse_file *ff) ...@@ -86,18 +86,52 @@ struct fuse_file *fuse_file_get(struct fuse_file *ff)
return ff; return ff;
} }
static void fuse_release_async(struct work_struct *work)
{
struct fuse_req *req;
struct fuse_conn *fc;
struct path path;
req = container_of(work, struct fuse_req, misc.release.work);
path = req->misc.release.path;
fc = get_fuse_conn(path.dentry->d_inode);
fuse_put_request(fc, req);
path_put(&path);
}
static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req) static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
{ {
path_put(&req->misc.release.path); if (fc->destroy_req) {
/*
* If this is a fuseblk mount, then it's possible that
* releasing the path will result in releasing the
* super block and sending the DESTROY request. If
* the server is single threaded, this would hang.
* For this reason do the path_put() in a separate
* thread.
*/
atomic_inc(&req->count);
INIT_WORK(&req->misc.release.work, fuse_release_async);
schedule_work(&req->misc.release.work);
} else {
path_put(&req->misc.release.path);
}
} }
static void fuse_file_put(struct fuse_file *ff) static void fuse_file_put(struct fuse_file *ff, bool sync)
{ {
if (atomic_dec_and_test(&ff->count)) { if (atomic_dec_and_test(&ff->count)) {
struct fuse_req *req = ff->reserved_req; struct fuse_req *req = ff->reserved_req;
req->end = fuse_release_end; if (sync) {
fuse_request_send_background(ff->fc, req); fuse_request_send(ff->fc, req);
path_put(&req->misc.release.path);
fuse_put_request(ff->fc, req);
} else {
req->end = fuse_release_end;
fuse_request_send_background(ff->fc, req);
}
kfree(ff); kfree(ff);
} }
} }
...@@ -219,8 +253,12 @@ void fuse_release_common(struct file *file, int opcode) ...@@ -219,8 +253,12 @@ void fuse_release_common(struct file *file, int opcode)
* Normally this will send the RELEASE request, however if * Normally this will send the RELEASE request, however if
* some asynchronous READ or WRITE requests are outstanding, * some asynchronous READ or WRITE requests are outstanding,
* the sending will be delayed. * the sending will be delayed.
*
* Make the release synchronous if this is a fuseblk mount,
* synchronous RELEASE is allowed (and desirable) in this case
* because the server can be trusted not to screw up.
*/ */
fuse_file_put(ff); fuse_file_put(ff, ff->fc->destroy_req != NULL);
} }
static int fuse_open(struct inode *inode, struct file *file) static int fuse_open(struct inode *inode, struct file *file)
...@@ -558,7 +596,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req) ...@@ -558,7 +596,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
page_cache_release(page); page_cache_release(page);
} }
if (req->ff) if (req->ff)
fuse_file_put(req->ff); fuse_file_put(req->ff, false);
} }
static void fuse_send_readpages(struct fuse_req *req, struct file *file) static void fuse_send_readpages(struct fuse_req *req, struct file *file)
...@@ -1137,7 +1175,7 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf, ...@@ -1137,7 +1175,7 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req) static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
{ {
__free_page(req->pages[0]); __free_page(req->pages[0]);
fuse_file_put(req->ff); fuse_file_put(req->ff, false);
} }
static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req) static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
......
...@@ -21,6 +21,7 @@ ...@@ -21,6 +21,7 @@
#include <linux/rwsem.h> #include <linux/rwsem.h>
#include <linux/rbtree.h> #include <linux/rbtree.h>
#include <linux/poll.h> #include <linux/poll.h>
#include <linux/workqueue.h>
/** Max number of pages that can be used in a single read request */ /** Max number of pages that can be used in a single read request */
#define FUSE_MAX_PAGES_PER_REQ 32 #define FUSE_MAX_PAGES_PER_REQ 32
...@@ -262,7 +263,10 @@ struct fuse_req { ...@@ -262,7 +263,10 @@ struct fuse_req {
/** Data for asynchronous requests */ /** Data for asynchronous requests */
union { union {
struct { struct {
struct fuse_release_in in; union {
struct fuse_release_in in;
struct work_struct work;
};
struct path path; struct path path;
} release; } release;
struct fuse_init_in init_in; struct fuse_init_in init_in;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment