[fuse] fix deadlock between fuse_put_super() and request_end()

A deadlock was possible, when the last reference to the superblock was
held due to a background request containing a file reference.

Releasing the file would release the vfsmount which in turn would
release the superblock.  Since sbput_sem is held during the fput() and
fuse_put_super() tries to acquire this same semaphore, a deadlock
results.

The chosen soltuion is to get rid of sbput_sem, and instead use the
spinlock to ensure the referenced inodes/file are released only once.
Since the actual release may sleep, defer these outside the locked
region, but using local variables instead of the structure members.

This is a much more rubust solution.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 6c740f8..d4efb62 100644 (file)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -120,20 +120,14 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
        }
 }
 
-void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)
+void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req)
 {
-       iput(req->inode);
-       iput(req->inode2);
-       if (req->file)
-               fput(req->file);
-       spin_lock(&fc->lock);
-       list_del(&req->bg_entry);
+       list_del_init(&req->bg_entry);
        if (fc->num_background == FUSE_MAX_BACKGROUND) {
                fc->blocked = 0;
                wake_up_all(&fc->blocked_waitq);
        }
        fc->num_background--;
-       spin_unlock(&fc->lock);
 }
 
 /*
@@ -163,17 +157,27 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                wake_up(&req->waitq);
                fuse_put_request(fc, req);
        } else {
+               struct inode *inode = req->inode;
+               struct inode *inode2 = req->inode2;
+               struct file *file = req->file;
                void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
                req->end = NULL;
+               req->inode = NULL;
+               req->inode2 = NULL;
+               req->file = NULL;
+               if (!list_empty(&req->bg_entry))
+                       fuse_remove_background(fc, req);
                spin_unlock(&fc->lock);
-               down_read(&fc->sbput_sem);
-               if (fc->mounted)
-                       fuse_release_background(fc, req);
-               up_read(&fc->sbput_sem);
+
                if (end)
                        end(fc, req);
                else
                        fuse_put_request(fc, req);
+
+               if (file)
+                       fput(file);
+               iput(inode);
+               iput(inode2);
        }
 }
 

diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 19c7185..ee9b830 100644 (file)
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -255,15 +255,9 @@ struct fuse_conn {
        /** waitq for blocked connection */
        wait_queue_head_t blocked_waitq;
 
-       /** RW semaphore for exclusion with fuse_put_super() */
-       struct rw_semaphore sbput_sem;
-
        /** The next unique request id */
        u64 reqctr;
 
-       /** Mount is active */
-       unsigned mounted;
-
        /** Connection established, cleared on umount, connection
            abort and device release */
        unsigned connected;
@@ -474,11 +468,11 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req);
 void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
 
 /**
- * Release inodes and file associated with background request
+ * Remove request from the the background list
  */
-void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);
+void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req);
 
-/* Abort all requests */
+/** Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
 
 /**

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index fd34037..43a6fc0 100644 (file)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -204,17 +204,26 @@ static void fuse_put_super(struct super_block *sb)
 {
        struct fuse_conn *fc = get_fuse_conn_super(sb);
 
-       down_write(&fc->sbput_sem);
-       while (!list_empty(&fc->background))
-               fuse_release_background(fc,
-                                       list_entry(fc->background.next,
-                                                  struct fuse_req, bg_entry));
-
        spin_lock(&fc->lock);
-       fc->mounted = 0;
        fc->connected = 0;
+       while (!list_empty(&fc->background)) {
+               struct fuse_req *req = list_entry(fc->background.next,
+                                                 struct fuse_req, bg_entry);
+               struct inode *inode = req->inode;
+               struct inode *inode2 = req->inode2;
+
+               /* File would hold a reference to vfsmount */
+               BUG_ON(req->file);
+               req->inode = NULL;
+               req->inode2 = NULL;
+               fuse_remove_background(fc, req);
+
+               spin_unlock(&fc->lock);
+               iput(inode);
+               iput(inode2);
+               spin_lock(&fc->lock);
+       }
        spin_unlock(&fc->lock);
-       up_write(&fc->sbput_sem);
        /* Flush all readers on this fs */
        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
        wake_up_all(&fc->waitq);
@@ -386,7 +395,6 @@ static struct fuse_conn *new_conn(void)
                INIT_LIST_HEAD(&fc->processing);
                INIT_LIST_HEAD(&fc->io);
                INIT_LIST_HEAD(&fc->background);
-               init_rwsem(&fc->sbput_sem);
                kobj_set_kset_s(fc, connections_subsys);
                kobject_init(&fc->kobj);
                atomic_set(&fc->num_waiting, 0);
@@ -541,7 +549,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
                goto err_free_req;
 
        sb->s_root = root_dentry;
-       fc->mounted = 1;
        fc->connected = 1;
        kobject_get(&fc->kobj);
        file->private_data = fc;