Commit 73ce8355 authored by Miklos Szeredi's avatar Miklos Szeredi
Browse files

[fuse] fix deadlock between fuse_put_super() and request_end() 



A deadlock was possible, when the last reference to the superblock was
held due to a background request containing a file reference.

Releasing the file would release the vfsmount which in turn would
release the superblock.  Since sbput_sem is held during the fput() and
fuse_put_super() tries to acquire this same semaphore, a deadlock
results.

The chosen soltuion is to get rid of sbput_sem, and instead use the
spinlock to ensure the referenced inodes/file are released only once.
Since the actual release may sleep, defer these outside the locked
region, but using local variables instead of the structure members.

This is a much more rubust solution.

Signed-off-by: default avatarMiklos Szeredi <miklos@szeredi.hu>
parent 2514395e

fs/fuse/dev.c

+16 −12
Original line number Diff line number Diff line
@@ -120,20 +120,14 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req) 
	}

}



void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)

void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req)

{

	iput(req->inode);

	iput(req->inode2);

	if (req->file)

		fput(req->file);

	spin_lock(&fc->lock);

	list_del(&req->bg_entry);

	list_del_init(&req->bg_entry);

	if (fc->num_background == FUSE_MAX_BACKGROUND) {

		fc->blocked = 0;

		wake_up_all(&fc->blocked_waitq);

	}

	fc->num_background--;

	spin_unlock(&fc->lock);

}



/*
@@ -163,17 +157,27 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) 
		wake_up(&req->waitq);

		fuse_put_request(fc, req);

	} else {

		struct inode *inode = req->inode;

		struct inode *inode2 = req->inode2;

		struct file *file = req->file;

		void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;

		req->end = NULL;

		req->inode = NULL;

		req->inode2 = NULL;

		req->file = NULL;

		if (!list_empty(&req->bg_entry))

			fuse_remove_background(fc, req);

		spin_unlock(&fc->lock);

		down_read(&fc->sbput_sem);

		if (fc->mounted)

			fuse_release_background(fc, req);

		up_read(&fc->sbput_sem);



		if (end)

			end(fc, req);

		else

			fuse_put_request(fc, req);



		if (file)

			fput(file);

		iput(inode);

		iput(inode2);

	}

}

fs/fuse/fuse_i.h

+3 −9
Original line number Diff line number Diff line
@@ -255,15 +255,9 @@ struct fuse_conn { 
	/** waitq for blocked connection */

	wait_queue_head_t blocked_waitq;



	/** RW semaphore for exclusion with fuse_put_super() */

	struct rw_semaphore sbput_sem;



	/** The next unique request id */

	u64 reqctr;



	/** Mount is active */

	unsigned mounted;



	/** Connection established, cleared on umount, connection

	    abort and device release */

	unsigned connected;
@@ -474,11 +468,11 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req); 
void request_send_background(struct fuse_conn *fc, struct fuse_req *req);



/**

 * Release inodes and file associated with background request

 * Remove request from the the background list

 */

void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);

void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req);



/* Abort all requests */

/** Abort all requests */

void fuse_abort_conn(struct fuse_conn *fc);



/**

fs/fuse/inode.c

+17 −10
Original line number Diff line number Diff line
@@ -204,17 +204,26 @@ static void fuse_put_super(struct super_block *sb) 
{

	struct fuse_conn *fc = get_fuse_conn_super(sb);



	down_write(&fc->sbput_sem);

	while (!list_empty(&fc->background))

		fuse_release_background(fc,

					list_entry(fc->background.next,

						   struct fuse_req, bg_entry));



	spin_lock(&fc->lock);

	fc->mounted = 0;

	fc->connected = 0;

	while (!list_empty(&fc->background)) {

		struct fuse_req *req = list_entry(fc->background.next,

						  struct fuse_req, bg_entry);

		struct inode *inode = req->inode;

		struct inode *inode2 = req->inode2;



		/* File would hold a reference to vfsmount */

		BUG_ON(req->file);

		req->inode = NULL;

		req->inode2 = NULL;

		fuse_remove_background(fc, req);



		spin_unlock(&fc->lock);

		iput(inode);

		iput(inode2);

		spin_lock(&fc->lock);

	}

	spin_unlock(&fc->lock);

	up_write(&fc->sbput_sem);

	/* Flush all readers on this fs */

	kill_fasync(&fc->fasync, SIGIO, POLL_IN);

	wake_up_all(&fc->waitq);
@@ -386,7 +395,6 @@ static struct fuse_conn *new_conn(void) 
		INIT_LIST_HEAD(&fc->processing);

		INIT_LIST_HEAD(&fc->io);

		INIT_LIST_HEAD(&fc->background);

		init_rwsem(&fc->sbput_sem);

		kobj_set_kset_s(fc, connections_subsys);

		kobject_init(&fc->kobj);

		atomic_set(&fc->num_waiting, 0);
@@ -541,7 +549,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) 
		goto err_free_req;



	sb->s_root = root_dentry;

	fc->mounted = 1;

	fc->connected = 1;

	kobject_get(&fc->kobj);

	file->private_data = fc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE