dev.c 51.5 KB
Newer Older
M
Miklos Szeredi 已提交
1 2
/*
  FUSE: Filesystem in Userspace
M
Miklos Szeredi 已提交
3
  Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
M
Miklos Szeredi 已提交
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

  This program can be distributed under the terms of the GNU GPL.
  See the file COPYING.
*/

#include "fuse_i.h"

#include <linux/init.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/uio.h>
#include <linux/miscdevice.h>
#include <linux/pagemap.h>
#include <linux/file.h>
#include <linux/slab.h>
19
#include <linux/pipe_fs_i.h>
20 21
#include <linux/swap.h>
#include <linux/splice.h>
M
Miklos Szeredi 已提交
22 23

MODULE_ALIAS_MISCDEV(FUSE_MINOR);
24
MODULE_ALIAS("devname:fuse");
M
Miklos Szeredi 已提交
25

26
static struct kmem_cache *fuse_req_cachep;
M
Miklos Szeredi 已提交
27

28
static struct fuse_dev *fuse_get_dev(struct file *file)
M
Miklos Szeredi 已提交
29
{
M
Miklos Szeredi 已提交
30 31 32 33
	/*
	 * Lockless access is OK, because file->private data is set
	 * once during mount and is valid until the file is released.
	 */
34
	return ACCESS_ONCE(file->private_data);
M
Miklos Szeredi 已提交
35 36
}

37
static void fuse_request_init(struct fuse_req *req, struct page **pages,
38
			      struct fuse_page_desc *page_descs,
39
			      unsigned npages)
M
Miklos Szeredi 已提交
40 41
{
	memset(req, 0, sizeof(*req));
42
	memset(pages, 0, sizeof(*pages) * npages);
43
	memset(page_descs, 0, sizeof(*page_descs) * npages);
M
Miklos Szeredi 已提交
44
	INIT_LIST_HEAD(&req->list);
45
	INIT_LIST_HEAD(&req->intr_entry);
M
Miklos Szeredi 已提交
46 47
	init_waitqueue_head(&req->waitq);
	atomic_set(&req->count, 1);
48
	req->pages = pages;
49
	req->page_descs = page_descs;
50
	req->max_pages = npages;
M
Miklos Szeredi 已提交
51
	__set_bit(FR_PENDING, &req->flags);
M
Miklos Szeredi 已提交
52 53
}

54
static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
M
Miklos Szeredi 已提交
55
{
56 57 58
	struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
	if (req) {
		struct page **pages;
59
		struct fuse_page_desc *page_descs;
60

61
		if (npages <= FUSE_REQ_INLINE_PAGES) {
62
			pages = req->inline_pages;
63 64
			page_descs = req->inline_page_descs;
		} else {
65
			pages = kmalloc(sizeof(struct page *) * npages, flags);
66 67 68
			page_descs = kmalloc(sizeof(struct fuse_page_desc) *
					     npages, flags);
		}
69

70 71 72
		if (!pages || !page_descs) {
			kfree(pages);
			kfree(page_descs);
73 74 75 76
			kmem_cache_free(fuse_req_cachep, req);
			return NULL;
		}

77
		fuse_request_init(req, pages, page_descs, npages);
78
	}
M
Miklos Szeredi 已提交
79 80
	return req;
}
81 82 83 84 85

struct fuse_req *fuse_request_alloc(unsigned npages)
{
	return __fuse_request_alloc(npages, GFP_KERNEL);
}
86
EXPORT_SYMBOL_GPL(fuse_request_alloc);
M
Miklos Szeredi 已提交
87

88
struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
M
Miklos Szeredi 已提交
89
{
90
	return __fuse_request_alloc(npages, GFP_NOFS);
M
Miklos Szeredi 已提交
91 92
}

M
Miklos Szeredi 已提交
93 94
void fuse_request_free(struct fuse_req *req)
{
95
	if (req->pages != req->inline_pages) {
96
		kfree(req->pages);
97 98
		kfree(req->page_descs);
	}
M
Miklos Szeredi 已提交
99 100 101
	kmem_cache_free(fuse_req_cachep, req);
}

102
void __fuse_get_request(struct fuse_req *req)
M
Miklos Szeredi 已提交
103 104 105 106 107 108 109 110 111 112 113
{
	atomic_inc(&req->count);
}

/* Must be called with > 1 refcount */
static void __fuse_put_request(struct fuse_req *req)
{
	BUG_ON(atomic_read(&req->count) < 2);
	atomic_dec(&req->count);
}

114 115
static void fuse_req_init_context(struct fuse_req *req)
{
116 117
	req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
	req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
118 119 120
	req->in.h.pid = current->pid;
}

121 122 123 124 125 126 127
void fuse_set_initialized(struct fuse_conn *fc)
{
	/* Make sure stores before this are seen on another CPU */
	smp_wmb();
	fc->initialized = 1;
}

128 129 130 131 132
static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
{
	return !fc->initialized || (for_background && fc->blocked);
}

133 134
static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
				       bool for_background)
M
Miklos Szeredi 已提交
135
{
136 137
	struct fuse_req *req;
	int err;
138
	atomic_inc(&fc->num_waiting);
139 140 141

	if (fuse_block_alloc(fc, for_background)) {
		err = -EINTR;
A
Al Viro 已提交
142 143
		if (wait_event_killable_exclusive(fc->blocked_waitq,
				!fuse_block_alloc(fc, for_background)))
144 145
			goto out;
	}
146 147
	/* Matches smp_wmb() in fuse_set_initialized() */
	smp_rmb();
148

149 150 151 152
	err = -ENOTCONN;
	if (!fc->connected)
		goto out;

M
Miklos Szeredi 已提交
153 154 155 156
	err = -ECONNREFUSED;
	if (fc->conn_error)
		goto out;

M
Maxim Patlasov 已提交
157
	req = fuse_request_alloc(npages);
158
	err = -ENOMEM;
159 160 161
	if (!req) {
		if (for_background)
			wake_up(&fc->blocked_waitq);
162
		goto out;
163
	}
M
Miklos Szeredi 已提交
164

165
	fuse_req_init_context(req);
M
Miklos Szeredi 已提交
166 167 168 169
	__set_bit(FR_WAITING, &req->flags);
	if (for_background)
		__set_bit(FR_BACKGROUND, &req->flags);

M
Miklos Szeredi 已提交
170
	return req;
171 172 173 174

 out:
	atomic_dec(&fc->num_waiting);
	return ERR_PTR(err);
M
Miklos Szeredi 已提交
175
}
176 177 178 179 180

struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
{
	return __fuse_get_req(fc, npages, false);
}
181
EXPORT_SYMBOL_GPL(fuse_get_req);
M
Miklos Szeredi 已提交
182

183 184 185 186 187 188 189
struct fuse_req *fuse_get_req_for_background(struct fuse_conn *fc,
					     unsigned npages)
{
	return __fuse_get_req(fc, npages, true);
}
EXPORT_SYMBOL_GPL(fuse_get_req_for_background);

190 191 192 193 194 195 196 197 198 199 200 201
/*
 * Return request in fuse_file->reserved_req.  However that may
 * currently be in use.  If that is the case, wait for it to become
 * available.
 */
static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
					 struct file *file)
{
	struct fuse_req *req = NULL;
	struct fuse_file *ff = file->private_data;

	do {
202
		wait_event(fc->reserved_req_waitq, ff->reserved_req);
203 204 205 206
		spin_lock(&fc->lock);
		if (ff->reserved_req) {
			req = ff->reserved_req;
			ff->reserved_req = NULL;
A
Al Viro 已提交
207
			req->stolen_file = get_file(file);
208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223
		}
		spin_unlock(&fc->lock);
	} while (!req);

	return req;
}

/*
 * Put stolen request back into fuse_file->reserved_req
 */
static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
{
	struct file *file = req->stolen_file;
	struct fuse_file *ff = file->private_data;

	spin_lock(&fc->lock);
224
	fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
225 226
	BUG_ON(ff->reserved_req);
	ff->reserved_req = req;
227
	wake_up_all(&fc->reserved_req_waitq);
228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244
	spin_unlock(&fc->lock);
	fput(file);
}

/*
 * Gets a requests for a file operation, always succeeds
 *
 * This is used for sending the FLUSH request, which must get to
 * userspace, due to POSIX locks which may need to be unlocked.
 *
 * If allocation fails due to OOM, use the reserved request in
 * fuse_file.
 *
 * This is very unlikely to deadlock accidentally, since the
 * filesystem should not have it's own file open.  If deadlock is
 * intentional, it can still be broken by "aborting" the filesystem.
 */
M
Maxim Patlasov 已提交
245 246
struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
					     struct file *file)
247 248 249 250
{
	struct fuse_req *req;

	atomic_inc(&fc->num_waiting);
251
	wait_event(fc->blocked_waitq, fc->initialized);
252 253
	/* Matches smp_wmb() in fuse_set_initialized() */
	smp_rmb();
M
Maxim Patlasov 已提交
254
	req = fuse_request_alloc(0);
255 256 257 258
	if (!req)
		req = get_reserved_req(fc, file);

	fuse_req_init_context(req);
M
Miklos Szeredi 已提交
259 260
	__set_bit(FR_WAITING, &req->flags);
	__clear_bit(FR_BACKGROUND, &req->flags);
261 262 263
	return req;
}

M
Miklos Szeredi 已提交
264
void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
265 266
{
	if (atomic_dec_and_test(&req->count)) {
M
Miklos Szeredi 已提交
267
		if (test_bit(FR_BACKGROUND, &req->flags)) {
268 269 270 271 272 273 274 275 276 277
			/*
			 * We get here in the unlikely case that a background
			 * request was allocated but not sent
			 */
			spin_lock(&fc->lock);
			if (!fc->blocked)
				wake_up(&fc->blocked_waitq);
			spin_unlock(&fc->lock);
		}

M
Miklos Szeredi 已提交
278 279
		if (test_bit(FR_WAITING, &req->flags)) {
			__clear_bit(FR_WAITING, &req->flags);
280
			atomic_dec(&fc->num_waiting);
M
Miklos Szeredi 已提交
281
		}
282 283 284 285 286

		if (req->stolen_file)
			put_reserved_req(fc, req);
		else
			fuse_request_free(req);
287 288
	}
}
289
EXPORT_SYMBOL_GPL(fuse_put_request);
290

291 292 293 294 295 296 297 298 299 300 301
static unsigned len_args(unsigned numargs, struct fuse_arg *args)
{
	unsigned nbytes = 0;
	unsigned i;

	for (i = 0; i < numargs; i++)
		nbytes += args[i].size;

	return nbytes;
}

M
Miklos Szeredi 已提交
302
static u64 fuse_get_unique(struct fuse_iqueue *fiq)
303
{
M
Miklos Szeredi 已提交
304
	return ++fiq->reqctr;
305 306
}

M
Miklos Szeredi 已提交
307
static void queue_request(struct fuse_iqueue *fiq, struct fuse_req *req)
308 309 310
{
	req->in.h.len = sizeof(struct fuse_in_header) +
		len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
M
Miklos Szeredi 已提交
311
	list_add_tail(&req->list, &fiq->pending);
M
Miklos Szeredi 已提交
312
	wake_up_locked(&fiq->waitq);
M
Miklos Szeredi 已提交
313
	kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
314 315
}

316 317 318
void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
		       u64 nodeid, u64 nlookup)
{
M
Miklos Szeredi 已提交
319 320
	struct fuse_iqueue *fiq = &fc->iq;

321 322
	forget->forget_one.nodeid = nodeid;
	forget->forget_one.nlookup = nlookup;
323

M
Miklos Szeredi 已提交
324
	spin_lock(&fiq->waitq.lock);
325
	if (fiq->connected) {
M
Miklos Szeredi 已提交
326 327
		fiq->forget_list_tail->next = forget;
		fiq->forget_list_tail = forget;
M
Miklos Szeredi 已提交
328
		wake_up_locked(&fiq->waitq);
M
Miklos Szeredi 已提交
329
		kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
M
Miklos Szeredi 已提交
330 331 332
	} else {
		kfree(forget);
	}
M
Miklos Szeredi 已提交
333
	spin_unlock(&fiq->waitq.lock);
334 335
}

336 337
static void flush_bg_queue(struct fuse_conn *fc)
{
338
	while (fc->active_background < fc->max_background &&
339 340
	       !list_empty(&fc->bg_queue)) {
		struct fuse_req *req;
M
Miklos Szeredi 已提交
341
		struct fuse_iqueue *fiq = &fc->iq;
342 343 344 345

		req = list_entry(fc->bg_queue.next, struct fuse_req, list);
		list_del(&req->list);
		fc->active_background++;
M
Miklos Szeredi 已提交
346
		spin_lock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
347 348
		req->in.h.unique = fuse_get_unique(fiq);
		queue_request(fiq, req);
M
Miklos Szeredi 已提交
349
		spin_unlock(&fiq->waitq.lock);
350 351 352
	}
}

M
Miklos Szeredi 已提交
353 354
/*
 * This function is called when a request is finished.  Either a reply
355
 * has arrived or it was aborted (and not yet sent) or some error
M
Miklos Szeredi 已提交
356
 * occurred during communication with userspace, or the device file
357 358 359
 * was closed.  The requester thread is woken up (if still waiting),
 * the 'end' callback is called if given, else the reference to the
 * request is released
M
Miklos Szeredi 已提交
360 361 362
 */
static void request_end(struct fuse_conn *fc, struct fuse_req *req)
{
M
Miklos Szeredi 已提交
363
	struct fuse_iqueue *fiq = &fc->iq;
M
Miklos Szeredi 已提交
364

365
	if (test_and_set_bit(FR_FINISHED, &req->flags))
M
Miklos Szeredi 已提交
366 367
		return;

M
Miklos Szeredi 已提交
368
	spin_lock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
369
	list_del_init(&req->intr_entry);
M
Miklos Szeredi 已提交
370
	spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
371 372
	WARN_ON(test_bit(FR_PENDING, &req->flags));
	WARN_ON(test_bit(FR_SENT, &req->flags));
M
Miklos Szeredi 已提交
373
	if (test_bit(FR_BACKGROUND, &req->flags)) {
374
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
375
		clear_bit(FR_BACKGROUND, &req->flags);
376
		if (fc->num_background == fc->max_background)
377
			fc->blocked = 0;
378 379

		/* Wake up next waiter, if any */
M
Miklos Szeredi 已提交
380
		if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
381 382
			wake_up(&fc->blocked_waitq);

383
		if (fc->num_background == fc->congestion_threshold &&
384
		    fc->connected && fc->bdi_initialized) {
385 386
			clear_bdi_congested(&fc->bdi, BLK_RW_SYNC);
			clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
387
		}
388
		fc->num_background--;
389 390
		fc->active_background--;
		flush_bg_queue(fc);
391
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
392
	}
393
	wake_up(&req->waitq);
M
Miklos Szeredi 已提交
394 395
	if (req->end)
		req->end(fc, req);
396
	fuse_put_request(fc, req);
M
Miklos Szeredi 已提交
397 398
}

M
Miklos Szeredi 已提交
399
static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)
400
{
M
Miklos Szeredi 已提交
401
	spin_lock(&fiq->waitq.lock);
402 403 404 405
	if (list_empty(&req->intr_entry)) {
		list_add_tail(&req->intr_entry, &fiq->interrupts);
		wake_up_locked(&fiq->waitq);
	}
M
Miklos Szeredi 已提交
406
	spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
407
	kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
408 409
}

410
static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
411
{
M
Miklos Szeredi 已提交
412
	struct fuse_iqueue *fiq = &fc->iq;
413 414
	int err;

415 416
	if (!fc->no_interrupt) {
		/* Any signal may interrupt this */
417
		err = wait_event_interruptible(req->waitq,
M
Miklos Szeredi 已提交
418
					test_bit(FR_FINISHED, &req->flags));
419
		if (!err)
420 421
			return;

M
Miklos Szeredi 已提交
422
		set_bit(FR_INTERRUPTED, &req->flags);
423 424
		/* matches barrier in fuse_dev_do_read() */
		smp_mb__after_atomic();
M
Miklos Szeredi 已提交
425
		if (test_bit(FR_SENT, &req->flags))
M
Miklos Szeredi 已提交
426
			queue_interrupt(fiq, req);
427 428
	}

M
Miklos Szeredi 已提交
429
	if (!test_bit(FR_FORCE, &req->flags)) {
430
		/* Only fatal signals may interrupt this */
A
Al Viro 已提交
431
		err = wait_event_killable(req->waitq,
M
Miklos Szeredi 已提交
432
					test_bit(FR_FINISHED, &req->flags));
433
		if (!err)
M
Miklos Szeredi 已提交
434 435
			return;

M
Miklos Szeredi 已提交
436
		spin_lock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
437
		/* Request is not yet in userspace, bail out */
M
Miklos Szeredi 已提交
438
		if (test_bit(FR_PENDING, &req->flags)) {
M
Miklos Szeredi 已提交
439
			list_del(&req->list);
M
Miklos Szeredi 已提交
440
			spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
441 442 443 444
			__fuse_put_request(req);
			req->out.h.error = -EINTR;
			return;
		}
M
Miklos Szeredi 已提交
445
		spin_unlock(&fiq->waitq.lock);
446
	}
M
Miklos Szeredi 已提交
447

M
Miklos Szeredi 已提交
448 449 450 451
	/*
	 * Either request is already in userspace, or it was forced.
	 * Wait it out.
	 */
M
Miklos Szeredi 已提交
452
	wait_event(req->waitq, test_bit(FR_FINISHED, &req->flags));
M
Miklos Szeredi 已提交
453 454
}

455
static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
456
{
457 458
	struct fuse_iqueue *fiq = &fc->iq;

M
Miklos Szeredi 已提交
459
	BUG_ON(test_bit(FR_BACKGROUND, &req->flags));
M
Miklos Szeredi 已提交
460
	spin_lock(&fiq->waitq.lock);
461
	if (!fiq->connected) {
M
Miklos Szeredi 已提交
462
		spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
463
		req->out.h.error = -ENOTCONN;
464
	} else {
M
Miklos Szeredi 已提交
465 466
		req->in.h.unique = fuse_get_unique(fiq);
		queue_request(fiq, req);
M
Miklos Szeredi 已提交
467 468 469
		/* acquire extra reference, since request is still needed
		   after request_end() */
		__fuse_get_request(req);
M
Miklos Szeredi 已提交
470
		spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
471

472
		request_wait_answer(fc, req);
473 474
		/* Pairs with smp_wmb() in request_end() */
		smp_rmb();
M
Miklos Szeredi 已提交
475 476
	}
}
477 478 479

void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
{
M
Miklos Szeredi 已提交
480 481 482
	__set_bit(FR_ISREPLY, &req->flags);
	if (!test_bit(FR_WAITING, &req->flags)) {
		__set_bit(FR_WAITING, &req->flags);
483 484
		atomic_inc(&fc->num_waiting);
	}
485 486
	__fuse_request_send(fc, req);
}
487
EXPORT_SYMBOL_GPL(fuse_request_send);
M
Miklos Szeredi 已提交
488

489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521
static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args)
{
	if (fc->minor < 4 && args->in.h.opcode == FUSE_STATFS)
		args->out.args[0].size = FUSE_COMPAT_STATFS_SIZE;

	if (fc->minor < 9) {
		switch (args->in.h.opcode) {
		case FUSE_LOOKUP:
		case FUSE_CREATE:
		case FUSE_MKNOD:
		case FUSE_MKDIR:
		case FUSE_SYMLINK:
		case FUSE_LINK:
			args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
			break;
		case FUSE_GETATTR:
		case FUSE_SETATTR:
			args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
			break;
		}
	}
	if (fc->minor < 12) {
		switch (args->in.h.opcode) {
		case FUSE_CREATE:
			args->in.args[0].size = sizeof(struct fuse_open_in);
			break;
		case FUSE_MKNOD:
			args->in.args[0].size = FUSE_COMPAT_MKNOD_IN_SIZE;
			break;
		}
	}
}

522 523 524 525 526 527 528 529 530
ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
{
	struct fuse_req *req;
	ssize_t ret;

	req = fuse_get_req(fc, 0);
	if (IS_ERR(req))
		return PTR_ERR(req);

531 532 533
	/* Needs to be done after fuse_get_req() so that fc->minor is valid */
	fuse_adjust_compat(fc, args);

534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553
	req->in.h.opcode = args->in.h.opcode;
	req->in.h.nodeid = args->in.h.nodeid;
	req->in.numargs = args->in.numargs;
	memcpy(req->in.args, args->in.args,
	       args->in.numargs * sizeof(struct fuse_in_arg));
	req->out.argvar = args->out.argvar;
	req->out.numargs = args->out.numargs;
	memcpy(req->out.args, args->out.args,
	       args->out.numargs * sizeof(struct fuse_arg));
	fuse_request_send(fc, req);
	ret = req->out.h.error;
	if (!ret && args->out.argvar) {
		BUG_ON(args->out.numargs != 1);
		ret = req->out.args[0].size;
	}
	fuse_put_request(fc, req);

	return ret;
}

554 555 556 557 558 559 560
/*
 * Called under fc->lock
 *
 * fc->connected must have been checked previously
 */
void fuse_request_send_background_locked(struct fuse_conn *fc,
					 struct fuse_req *req)
561
{
M
Miklos Szeredi 已提交
562 563 564
	BUG_ON(!test_bit(FR_BACKGROUND, &req->flags));
	if (!test_bit(FR_WAITING, &req->flags)) {
		__set_bit(FR_WAITING, &req->flags);
565 566
		atomic_inc(&fc->num_waiting);
	}
M
Miklos Szeredi 已提交
567
	__set_bit(FR_ISREPLY, &req->flags);
568
	fc->num_background++;
569
	if (fc->num_background == fc->max_background)
570
		fc->blocked = 1;
571
	if (fc->num_background == fc->congestion_threshold &&
572
	    fc->bdi_initialized) {
573 574
		set_bdi_congested(&fc->bdi, BLK_RW_SYNC);
		set_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
575 576 577 578 579
	}
	list_add_tail(&req->list, &fc->bg_queue);
	flush_bg_queue(fc);
}

580
void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
581
{
582
	BUG_ON(!req->end);
583
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
584
	if (fc->connected) {
585
		fuse_request_send_background_locked(fc, req);
586
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
587
	} else {
588
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
589
		req->out.h.error = -ENOTCONN;
590 591
		req->end(fc, req);
		fuse_put_request(fc, req);
M
Miklos Szeredi 已提交
592 593
	}
}
594
EXPORT_SYMBOL_GPL(fuse_request_send_background);
M
Miklos Szeredi 已提交
595

M
Miklos Szeredi 已提交
596 597 598 599
static int fuse_request_send_notify_reply(struct fuse_conn *fc,
					  struct fuse_req *req, u64 unique)
{
	int err = -ENODEV;
M
Miklos Szeredi 已提交
600
	struct fuse_iqueue *fiq = &fc->iq;
M
Miklos Szeredi 已提交
601

M
Miklos Szeredi 已提交
602
	__clear_bit(FR_ISREPLY, &req->flags);
M
Miklos Szeredi 已提交
603
	req->in.h.unique = unique;
M
Miklos Szeredi 已提交
604
	spin_lock(&fiq->waitq.lock);
605
	if (fiq->connected) {
M
Miklos Szeredi 已提交
606
		queue_request(fiq, req);
M
Miklos Szeredi 已提交
607 608
		err = 0;
	}
M
Miklos Szeredi 已提交
609
	spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
610 611 612 613

	return err;
}

614 615
void fuse_force_forget(struct file *file, u64 nodeid)
{
A
Al Viro 已提交
616
	struct inode *inode = file_inode(file);
617 618 619 620 621 622
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_req *req;
	struct fuse_forget_in inarg;

	memset(&inarg, 0, sizeof(inarg));
	inarg.nlookup = 1;
M
Maxim Patlasov 已提交
623
	req = fuse_get_req_nofail_nopages(fc, file);
624 625 626 627 628
	req->in.h.opcode = FUSE_FORGET;
	req->in.h.nodeid = nodeid;
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
M
Miklos Szeredi 已提交
629
	__clear_bit(FR_ISREPLY, &req->flags);
630 631 632
	__fuse_request_send(fc, req);
	/* ignore errors */
	fuse_put_request(fc, req);
633 634
}

M
Miklos Szeredi 已提交
635 636 637
/*
 * Lock the request.  Up to the next unlock_request() there mustn't be
 * anything that could cause a page-fault.  If the request was already
638
 * aborted bail out.
M
Miklos Szeredi 已提交
639
 */
640
static int lock_request(struct fuse_req *req)
M
Miklos Szeredi 已提交
641 642 643
{
	int err = 0;
	if (req) {
644
		spin_lock(&req->waitq.lock);
M
Miklos Szeredi 已提交
645
		if (test_bit(FR_ABORTED, &req->flags))
M
Miklos Szeredi 已提交
646 647
			err = -ENOENT;
		else
M
Miklos Szeredi 已提交
648
			set_bit(FR_LOCKED, &req->flags);
649
		spin_unlock(&req->waitq.lock);
M
Miklos Szeredi 已提交
650 651 652 653 654
	}
	return err;
}

/*
M
Miklos Szeredi 已提交
655 656
 * Unlock request.  If it was aborted while locked, caller is responsible
 * for unlocking and ending the request.
M
Miklos Szeredi 已提交
657
 */
658
static int unlock_request(struct fuse_req *req)
M
Miklos Szeredi 已提交
659
{
M
Miklos Szeredi 已提交
660
	int err = 0;
M
Miklos Szeredi 已提交
661
	if (req) {
662
		spin_lock(&req->waitq.lock);
M
Miklos Szeredi 已提交
663
		if (test_bit(FR_ABORTED, &req->flags))
M
Miklos Szeredi 已提交
664 665
			err = -ENOENT;
		else
M
Miklos Szeredi 已提交
666
			clear_bit(FR_LOCKED, &req->flags);
667
		spin_unlock(&req->waitq.lock);
M
Miklos Szeredi 已提交
668
	}
M
Miklos Szeredi 已提交
669
	return err;
M
Miklos Szeredi 已提交
670 671 672 673 674
}

struct fuse_copy_state {
	int write;
	struct fuse_req *req;
675
	struct iov_iter *iter;
676 677 678
	struct pipe_buffer *pipebufs;
	struct pipe_buffer *currbuf;
	struct pipe_inode_info *pipe;
M
Miklos Szeredi 已提交
679 680 681
	unsigned long nr_segs;
	struct page *pg;
	unsigned len;
682
	unsigned offset;
683
	unsigned move_pages:1;
M
Miklos Szeredi 已提交
684 685
};

686
static void fuse_copy_init(struct fuse_copy_state *cs, int write,
687
			   struct iov_iter *iter)
M
Miklos Szeredi 已提交
688 689 690
{
	memset(cs, 0, sizeof(*cs));
	cs->write = write;
691
	cs->iter = iter;
M
Miklos Szeredi 已提交
692 693 694
}

/* Unmap and put previous page of userspace buffer */
695
static void fuse_copy_finish(struct fuse_copy_state *cs)
M
Miklos Szeredi 已提交
696
{
697 698 699
	if (cs->currbuf) {
		struct pipe_buffer *buf = cs->currbuf;

700
		if (cs->write)
701
			buf->len = PAGE_SIZE - cs->len;
702
		cs->currbuf = NULL;
703
	} else if (cs->pg) {
M
Miklos Szeredi 已提交
704 705 706 707 708 709
		if (cs->write) {
			flush_dcache_page(cs->pg);
			set_page_dirty_lock(cs->pg);
		}
		put_page(cs->pg);
	}
710
	cs->pg = NULL;
M
Miklos Szeredi 已提交
711 712 713 714 715 716 717 718
}

/*
 * Get another pagefull of userspace buffer, and map it to kernel
 * address space, and lock request
 */
static int fuse_copy_fill(struct fuse_copy_state *cs)
{
719
	struct page *page;
M
Miklos Szeredi 已提交
720 721
	int err;

722
	err = unlock_request(cs->req);
M
Miklos Szeredi 已提交
723 724 725
	if (err)
		return err;

M
Miklos Szeredi 已提交
726
	fuse_copy_finish(cs);
727 728 729
	if (cs->pipebufs) {
		struct pipe_buffer *buf = cs->pipebufs;

730 731 732 733 734 735 736
		if (!cs->write) {
			err = buf->ops->confirm(cs->pipe, buf);
			if (err)
				return err;

			BUG_ON(!cs->nr_segs);
			cs->currbuf = buf;
737 738
			cs->pg = buf->page;
			cs->offset = buf->offset;
739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754
			cs->len = buf->len;
			cs->pipebufs++;
			cs->nr_segs--;
		} else {
			if (cs->nr_segs == cs->pipe->buffers)
				return -EIO;

			page = alloc_page(GFP_HIGHUSER);
			if (!page)
				return -ENOMEM;

			buf->page = page;
			buf->offset = 0;
			buf->len = 0;

			cs->currbuf = buf;
755 756
			cs->pg = page;
			cs->offset = 0;
757 758 759 760
			cs->len = PAGE_SIZE;
			cs->pipebufs++;
			cs->nr_segs++;
		}
761
	} else {
762 763
		size_t off;
		err = iov_iter_get_pages(cs->iter, &page, PAGE_SIZE, 1, &off);
764 765
		if (err < 0)
			return err;
766 767 768
		BUG_ON(!err);
		cs->len = err;
		cs->offset = off;
769
		cs->pg = page;
770 771
		cs->offset = off;
		iov_iter_advance(cs->iter, err);
M
Miklos Szeredi 已提交
772 773
	}

774
	return lock_request(cs->req);
M
Miklos Szeredi 已提交
775 776 777
}

/* Do as much copy to/from userspace buffer as we can */
778
static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
M
Miklos Szeredi 已提交
779 780 781
{
	unsigned ncpy = min(*size, cs->len);
	if (val) {
782 783 784
		void *pgaddr = kmap_atomic(cs->pg);
		void *buf = pgaddr + cs->offset;

M
Miklos Szeredi 已提交
785
		if (cs->write)
786
			memcpy(buf, *val, ncpy);
M
Miklos Szeredi 已提交
787
		else
788 789 790
			memcpy(*val, buf, ncpy);

		kunmap_atomic(pgaddr);
M
Miklos Szeredi 已提交
791 792 793 794
		*val += ncpy;
	}
	*size -= ncpy;
	cs->len -= ncpy;
795
	cs->offset += ncpy;
M
Miklos Szeredi 已提交
796 797 798
	return ncpy;
}

799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824
static int fuse_check_page(struct page *page)
{
	if (page_mapcount(page) ||
	    page->mapping != NULL ||
	    page_count(page) != 1 ||
	    (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
	     ~(1 << PG_locked |
	       1 << PG_referenced |
	       1 << PG_uptodate |
	       1 << PG_lru |
	       1 << PG_active |
	       1 << PG_reclaim))) {
		printk(KERN_WARNING "fuse: trying to steal weird page\n");
		printk(KERN_WARNING "  page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
		return 1;
	}
	return 0;
}

static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
{
	int err;
	struct page *oldpage = *pagep;
	struct page *newpage;
	struct pipe_buffer *buf = cs->pipebufs;

825
	err = unlock_request(cs->req);
M
Miklos Szeredi 已提交
826 827 828
	if (err)
		return err;

829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848
	fuse_copy_finish(cs);

	err = buf->ops->confirm(cs->pipe, buf);
	if (err)
		return err;

	BUG_ON(!cs->nr_segs);
	cs->currbuf = buf;
	cs->len = buf->len;
	cs->pipebufs++;
	cs->nr_segs--;

	if (cs->len != PAGE_SIZE)
		goto out_fallback;

	if (buf->ops->steal(cs->pipe, buf) != 0)
		goto out_fallback;

	newpage = buf->page;

M
Miklos Szeredi 已提交
849 850
	if (!PageUptodate(newpage))
		SetPageUptodate(newpage);
851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869

	ClearPageMappedToDisk(newpage);

	if (fuse_check_page(newpage) != 0)
		goto out_fallback_unlock;

	/*
	 * This is a new and locked page, it shouldn't be mapped or
	 * have any special flags on it
	 */
	if (WARN_ON(page_mapped(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(page_has_private(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(PageMlocked(oldpage)))
		goto out_fallback_unlock;

870
	err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
871
	if (err) {
872 873
		unlock_page(newpage);
		return err;
874
	}
875

876
	get_page(newpage);
877 878 879 880 881

	if (!(buf->flags & PIPE_BUF_FLAG_LRU))
		lru_cache_add_file(newpage);

	err = 0;
882
	spin_lock(&cs->req->waitq.lock);
M
Miklos Szeredi 已提交
883
	if (test_bit(FR_ABORTED, &cs->req->flags))
884 885 886
		err = -ENOENT;
	else
		*pagep = newpage;
887
	spin_unlock(&cs->req->waitq.lock);
888 889 890

	if (err) {
		unlock_page(newpage);
891
		put_page(newpage);
892 893 894 895
		return err;
	}

	unlock_page(oldpage);
896
	put_page(oldpage);
897 898 899 900 901 902 903
	cs->len = 0;

	return 0;

out_fallback_unlock:
	unlock_page(newpage);
out_fallback:
904 905
	cs->pg = buf->page;
	cs->offset = buf->offset;
906

907
	err = lock_request(cs->req);
908 909 910 911 912 913
	if (err)
		return err;

	return 1;
}

914 915 916 917
static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
			 unsigned offset, unsigned count)
{
	struct pipe_buffer *buf;
M
Miklos Szeredi 已提交
918
	int err;
919 920 921 922

	if (cs->nr_segs == cs->pipe->buffers)
		return -EIO;

923
	err = unlock_request(cs->req);
M
Miklos Szeredi 已提交
924 925 926
	if (err)
		return err;

927 928 929
	fuse_copy_finish(cs);

	buf = cs->pipebufs;
930
	get_page(page);
931 932 933 934 935 936 937 938 939 940 941
	buf->page = page;
	buf->offset = offset;
	buf->len = count;

	cs->pipebufs++;
	cs->nr_segs++;
	cs->len = 0;

	return 0;
}

M
Miklos Szeredi 已提交
942 943 944 945
/*
 * Copy a page in the request to/from the userspace buffer.  Must be
 * done atomically
 */
946
static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
947
			  unsigned offset, unsigned count, int zeroing)
M
Miklos Szeredi 已提交
948
{
949 950 951
	int err;
	struct page *page = *pagep;

952 953 954
	if (page && zeroing && count < PAGE_SIZE)
		clear_highpage(page);

M
Miklos Szeredi 已提交
955
	while (count) {
956 957 958
		if (cs->write && cs->pipebufs && page) {
			return fuse_ref_page(cs, page, offset, count);
		} else if (!cs->len) {
959 960 961 962 963 964 965 966 967 968
			if (cs->move_pages && page &&
			    offset == 0 && count == PAGE_SIZE) {
				err = fuse_try_move_page(cs, pagep);
				if (err <= 0)
					return err;
			} else {
				err = fuse_copy_fill(cs);
				if (err)
					return err;
			}
M
Miklos Szeredi 已提交
969
		}
M
Miklos Szeredi 已提交
970
		if (page) {
971
			void *mapaddr = kmap_atomic(page);
M
Miklos Szeredi 已提交
972 973
			void *buf = mapaddr + offset;
			offset += fuse_copy_do(cs, &buf, &count);
974
			kunmap_atomic(mapaddr);
M
Miklos Szeredi 已提交
975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990
		} else
			offset += fuse_copy_do(cs, NULL, &count);
	}
	if (page && !cs->write)
		flush_dcache_page(page);
	return 0;
}

/* Copy pages in the request to/from userspace buffer */
static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
			   int zeroing)
{
	unsigned i;
	struct fuse_req *req = cs->req;

	for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
991
		int err;
992 993
		unsigned offset = req->page_descs[i].offset;
		unsigned count = min(nbytes, req->page_descs[i].length);
994 995 996

		err = fuse_copy_page(cs, &req->pages[i], offset, count,
				     zeroing);
M
Miklos Szeredi 已提交
997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008
		if (err)
			return err;

		nbytes -= count;
	}
	return 0;
}

/* Copy a single argument in the request to/from userspace buffer */
static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
{
	while (size) {
M
Miklos Szeredi 已提交
1009 1010 1011 1012 1013
		if (!cs->len) {
			int err = fuse_copy_fill(cs);
			if (err)
				return err;
		}
M
Miklos Szeredi 已提交
1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036
		fuse_copy_do(cs, &val, &size);
	}
	return 0;
}

/* Copy request arguments to/from userspace buffer */
static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
			  unsigned argpages, struct fuse_arg *args,
			  int zeroing)
{
	int err = 0;
	unsigned i;

	for (i = 0; !err && i < numargs; i++)  {
		struct fuse_arg *arg = &args[i];
		if (i == numargs - 1 && argpages)
			err = fuse_copy_pages(cs, arg->size, zeroing);
		else
			err = fuse_copy_one(cs, arg->value, arg->size);
	}
	return err;
}

M
Miklos Szeredi 已提交
1037
static int forget_pending(struct fuse_iqueue *fiq)
1038
{
M
Miklos Szeredi 已提交
1039
	return fiq->forget_list_head.next != NULL;
1040 1041
}

M
Miklos Szeredi 已提交
1042
static int request_pending(struct fuse_iqueue *fiq)
1043
{
M
Miklos Szeredi 已提交
1044 1045
	return !list_empty(&fiq->pending) || !list_empty(&fiq->interrupts) ||
		forget_pending(fiq);
1046 1047 1048 1049 1050 1051 1052 1053
}

/*
 * Transfer an interrupt request to userspace
 *
 * Unlike other requests this is assembled on demand, without a need
 * to allocate a separate fuse_req structure.
 *
1054
 * Called with fiq->waitq.lock held, releases it
1055
 */
1056 1057
static int fuse_read_interrupt(struct fuse_iqueue *fiq,
			       struct fuse_copy_state *cs,
1058
			       size_t nbytes, struct fuse_req *req)
1059
__releases(fiq->waitq.lock)
1060 1061 1062 1063 1064 1065 1066
{
	struct fuse_in_header ih;
	struct fuse_interrupt_in arg;
	unsigned reqsize = sizeof(ih) + sizeof(arg);
	int err;

	list_del_init(&req->intr_entry);
M
Miklos Szeredi 已提交
1067
	req->intr_unique = fuse_get_unique(fiq);
1068 1069 1070 1071 1072 1073 1074
	memset(&ih, 0, sizeof(ih));
	memset(&arg, 0, sizeof(arg));
	ih.len = reqsize;
	ih.opcode = FUSE_INTERRUPT;
	ih.unique = req->intr_unique;
	arg.unique = req->in.h.unique;

M
Miklos Szeredi 已提交
1075
	spin_unlock(&fiq->waitq.lock);
1076
	if (nbytes < reqsize)
1077 1078
		return -EINVAL;

1079
	err = fuse_copy_one(cs, &ih, sizeof(ih));
1080
	if (!err)
1081 1082
		err = fuse_copy_one(cs, &arg, sizeof(arg));
	fuse_copy_finish(cs);
1083 1084 1085 1086

	return err ? err : reqsize;
}

M
Miklos Szeredi 已提交
1087
static struct fuse_forget_link *dequeue_forget(struct fuse_iqueue *fiq,
1088 1089
					       unsigned max,
					       unsigned *countp)
1090
{
M
Miklos Szeredi 已提交
1091
	struct fuse_forget_link *head = fiq->forget_list_head.next;
1092 1093
	struct fuse_forget_link **newhead = &head;
	unsigned count;
1094

1095 1096 1097
	for (count = 0; *newhead != NULL && count < max; count++)
		newhead = &(*newhead)->next;

M
Miklos Szeredi 已提交
1098
	fiq->forget_list_head.next = *newhead;
1099
	*newhead = NULL;
M
Miklos Szeredi 已提交
1100 1101
	if (fiq->forget_list_head.next == NULL)
		fiq->forget_list_tail = &fiq->forget_list_head;
1102

1103 1104 1105 1106
	if (countp != NULL)
		*countp = count;

	return head;
1107 1108
}

1109
static int fuse_read_single_forget(struct fuse_iqueue *fiq,
1110 1111
				   struct fuse_copy_state *cs,
				   size_t nbytes)
1112
__releases(fiq->waitq.lock)
1113 1114
{
	int err;
M
Miklos Szeredi 已提交
1115
	struct fuse_forget_link *forget = dequeue_forget(fiq, 1, NULL);
1116
	struct fuse_forget_in arg = {
1117
		.nlookup = forget->forget_one.nlookup,
1118 1119 1120
	};
	struct fuse_in_header ih = {
		.opcode = FUSE_FORGET,
1121
		.nodeid = forget->forget_one.nodeid,
M
Miklos Szeredi 已提交
1122
		.unique = fuse_get_unique(fiq),
1123 1124 1125
		.len = sizeof(ih) + sizeof(arg),
	};

M
Miklos Szeredi 已提交
1126
	spin_unlock(&fiq->waitq.lock);
1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141
	kfree(forget);
	if (nbytes < ih.len)
		return -EINVAL;

	err = fuse_copy_one(cs, &ih, sizeof(ih));
	if (!err)
		err = fuse_copy_one(cs, &arg, sizeof(arg));
	fuse_copy_finish(cs);

	if (err)
		return err;

	return ih.len;
}

1142
static int fuse_read_batch_forget(struct fuse_iqueue *fiq,
1143
				   struct fuse_copy_state *cs, size_t nbytes)
1144
__releases(fiq->waitq.lock)
1145 1146 1147 1148 1149 1150 1151 1152
{
	int err;
	unsigned max_forgets;
	unsigned count;
	struct fuse_forget_link *head;
	struct fuse_batch_forget_in arg = { .count = 0 };
	struct fuse_in_header ih = {
		.opcode = FUSE_BATCH_FORGET,
M
Miklos Szeredi 已提交
1153
		.unique = fuse_get_unique(fiq),
1154 1155 1156 1157
		.len = sizeof(ih) + sizeof(arg),
	};

	if (nbytes < ih.len) {
M
Miklos Szeredi 已提交
1158
		spin_unlock(&fiq->waitq.lock);
1159 1160 1161 1162
		return -EINVAL;
	}

	max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
M
Miklos Szeredi 已提交
1163
	head = dequeue_forget(fiq, max_forgets, &count);
M
Miklos Szeredi 已提交
1164
	spin_unlock(&fiq->waitq.lock);
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190

	arg.count = count;
	ih.len += count * sizeof(struct fuse_forget_one);
	err = fuse_copy_one(cs, &ih, sizeof(ih));
	if (!err)
		err = fuse_copy_one(cs, &arg, sizeof(arg));

	while (head) {
		struct fuse_forget_link *forget = head;

		if (!err) {
			err = fuse_copy_one(cs, &forget->forget_one,
					    sizeof(forget->forget_one));
		}
		head = forget->next;
		kfree(forget);
	}

	fuse_copy_finish(cs);

	if (err)
		return err;

	return ih.len;
}

1191 1192
static int fuse_read_forget(struct fuse_conn *fc, struct fuse_iqueue *fiq,
			    struct fuse_copy_state *cs,
1193
			    size_t nbytes)
1194
__releases(fiq->waitq.lock)
1195
{
M
Miklos Szeredi 已提交
1196
	if (fc->minor < 16 || fiq->forget_list_head.next->next == NULL)
1197
		return fuse_read_single_forget(fiq, cs, nbytes);
1198
	else
1199
		return fuse_read_batch_forget(fiq, cs, nbytes);
1200 1201
}

M
Miklos Szeredi 已提交
1202 1203 1204 1205
/*
 * Read a single request into the userspace filesystem's buffer.  This
 * function waits until a request is available, then removes it from
 * the pending list and copies request data to userspace buffer.  If
1206 1207
 * no reply is needed (FORGET) or request has been aborted or there
 * was an error during the copying then it's finished by calling
M
Miklos Szeredi 已提交
1208 1209 1210
 * request_end().  Otherwise add it to the processing list, and set
 * the 'sent' flag.
 */
1211
static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
1212
				struct fuse_copy_state *cs, size_t nbytes)
M
Miklos Szeredi 已提交
1213
{
1214
	ssize_t err;
1215
	struct fuse_conn *fc = fud->fc;
M
Miklos Szeredi 已提交
1216
	struct fuse_iqueue *fiq = &fc->iq;
1217
	struct fuse_pqueue *fpq = &fud->pq;
M
Miklos Szeredi 已提交
1218 1219 1220 1221
	struct fuse_req *req;
	struct fuse_in *in;
	unsigned reqsize;

1222
 restart:
M
Miklos Szeredi 已提交
1223
	spin_lock(&fiq->waitq.lock);
1224
	err = -EAGAIN;
1225
	if ((file->f_flags & O_NONBLOCK) && fiq->connected &&
M
Miklos Szeredi 已提交
1226
	    !request_pending(fiq))
1227 1228
		goto err_unlock;

M
Miklos Szeredi 已提交
1229 1230 1231 1232 1233
	err = wait_event_interruptible_exclusive_locked(fiq->waitq,
				!fiq->connected || request_pending(fiq));
	if (err)
		goto err_unlock;

M
Miklos Szeredi 已提交
1234
	err = -ENODEV;
1235
	if (!fiq->connected)
M
Miklos Szeredi 已提交
1236 1237
		goto err_unlock;

M
Miklos Szeredi 已提交
1238 1239
	if (!list_empty(&fiq->interrupts)) {
		req = list_entry(fiq->interrupts.next, struct fuse_req,
1240
				 intr_entry);
1241
		return fuse_read_interrupt(fiq, cs, nbytes, req);
1242 1243
	}

M
Miklos Szeredi 已提交
1244 1245
	if (forget_pending(fiq)) {
		if (list_empty(&fiq->pending) || fiq->forget_batch-- > 0)
1246
			return fuse_read_forget(fc, fiq, cs, nbytes);
1247

M
Miklos Szeredi 已提交
1248 1249
		if (fiq->forget_batch <= -8)
			fiq->forget_batch = 16;
1250 1251
	}

M
Miklos Szeredi 已提交
1252
	req = list_entry(fiq->pending.next, struct fuse_req, list);
M
Miklos Szeredi 已提交
1253
	clear_bit(FR_PENDING, &req->flags);
M
Miklos Szeredi 已提交
1254
	list_del_init(&req->list);
M
Miklos Szeredi 已提交
1255 1256
	spin_unlock(&fiq->waitq.lock);

M
Miklos Szeredi 已提交
1257
	in = &req->in;
1258 1259
	reqsize = in->h.len;
	/* If request is too large, reply with an error and restart the read */
1260
	if (nbytes < reqsize) {
1261 1262 1263 1264 1265 1266
		req->out.h.error = -EIO;
		/* SETXATTR is special, since it may contain too large data */
		if (in->h.opcode == FUSE_SETXATTR)
			req->out.h.error = -E2BIG;
		request_end(fc, req);
		goto restart;
M
Miklos Szeredi 已提交
1267
	}
M
Miklos Szeredi 已提交
1268
	spin_lock(&fpq->lock);
1269
	list_add(&req->list, &fpq->io);
M
Miklos Szeredi 已提交
1270
	spin_unlock(&fpq->lock);
1271 1272
	cs->req = req;
	err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1273
	if (!err)
1274
		err = fuse_copy_args(cs, in->numargs, in->argpages,
1275
				     (struct fuse_arg *) in->args, 0);
1276
	fuse_copy_finish(cs);
M
Miklos Szeredi 已提交
1277
	spin_lock(&fpq->lock);
M
Miklos Szeredi 已提交
1278
	clear_bit(FR_LOCKED, &req->flags);
1279
	if (!fpq->connected) {
1280 1281
		err = -ENODEV;
		goto out_end;
1282
	}
M
Miklos Szeredi 已提交
1283
	if (err) {
1284
		req->out.h.error = -EIO;
1285
		goto out_end;
M
Miklos Szeredi 已提交
1286
	}
M
Miklos Szeredi 已提交
1287
	if (!test_bit(FR_ISREPLY, &req->flags)) {
1288 1289
		err = reqsize;
		goto out_end;
M
Miklos Szeredi 已提交
1290
	}
1291
	list_move_tail(&req->list, &fpq->processing);
M
Miklos Szeredi 已提交
1292
	spin_unlock(&fpq->lock);
1293 1294 1295 1296 1297 1298
	set_bit(FR_SENT, &req->flags);
	/* matches barrier in request_wait_answer() */
	smp_mb__after_atomic();
	if (test_bit(FR_INTERRUPTED, &req->flags))
		queue_interrupt(fiq, req);

M
Miklos Szeredi 已提交
1299 1300
	return reqsize;

1301
out_end:
1302 1303
	if (!test_bit(FR_PRIVATE, &req->flags))
		list_del_init(&req->list);
M
Miklos Szeredi 已提交
1304
	spin_unlock(&fpq->lock);
1305 1306 1307
	request_end(fc, req);
	return err;

M
Miklos Szeredi 已提交
1308
 err_unlock:
M
Miklos Szeredi 已提交
1309
	spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
1310 1311 1312
	return err;
}

1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323
static int fuse_dev_open(struct inode *inode, struct file *file)
{
	/*
	 * The fuse device's file's private_data is used to hold
	 * the fuse_conn(ection) when it is mounted, and is used to
	 * keep track of whether the file has been mounted already.
	 */
	file->private_data = NULL;
	return 0;
}

1324
static ssize_t fuse_dev_read(struct kiocb *iocb, struct iov_iter *to)
1325 1326 1327
{
	struct fuse_copy_state cs;
	struct file *file = iocb->ki_filp;
1328 1329 1330
	struct fuse_dev *fud = fuse_get_dev(file);

	if (!fud)
1331 1332
		return -EPERM;

1333 1334 1335
	if (!iter_is_iovec(to))
		return -EINVAL;

1336
	fuse_copy_init(&cs, 1, to);
1337

1338
	return fuse_dev_do_read(fud, file, &cs, iov_iter_count(to));
1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349
}

static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
				    struct pipe_inode_info *pipe,
				    size_t len, unsigned int flags)
{
	int ret;
	int page_nr = 0;
	int do_wakeup = 0;
	struct pipe_buffer *bufs;
	struct fuse_copy_state cs;
1350 1351 1352
	struct fuse_dev *fud = fuse_get_dev(in);

	if (!fud)
1353 1354
		return -EPERM;

1355
	bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1356 1357 1358
	if (!bufs)
		return -ENOMEM;

1359
	fuse_copy_init(&cs, 1, NULL);
1360 1361
	cs.pipebufs = bufs;
	cs.pipe = pipe;
1362
	ret = fuse_dev_do_read(fud, in, &cs, len);
1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386
	if (ret < 0)
		goto out;

	ret = 0;

	if (!pipe->readers) {
		send_sig(SIGPIPE, current, 0);
		if (!ret)
			ret = -EPIPE;
		goto out_unlock;
	}

	if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
		ret = -EIO;
		goto out_unlock;
	}

	while (page_nr < cs.nr_segs) {
		int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
		struct pipe_buffer *buf = pipe->bufs + newbuf;

		buf->page = bufs[page_nr].page;
		buf->offset = bufs[page_nr].offset;
		buf->len = bufs[page_nr].len;
M
Miklos Szeredi 已提交
1387 1388 1389 1390 1391
		/*
		 * Need to be careful about this.  Having buf->ops in module
		 * code can Oops if the buffer persists after module unload.
		 */
		buf->ops = &nosteal_pipe_buf_ops;
1392 1393 1394 1395 1396

		pipe->nrbufs++;
		page_nr++;
		ret += buf->len;

A
Al Viro 已提交
1397
		if (pipe->files)
1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411
			do_wakeup = 1;
	}

out_unlock:

	if (do_wakeup) {
		smp_mb();
		if (waitqueue_active(&pipe->wait))
			wake_up_interruptible(&pipe->wait);
		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
	}

out:
	for (; page_nr < cs.nr_segs; page_nr++)
1412
		put_page(bufs[page_nr].page);
1413 1414 1415 1416 1417

	kfree(bufs);
	return ret;
}

T
Tejun Heo 已提交
1418 1419 1420 1421
static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
			    struct fuse_copy_state *cs)
{
	struct fuse_notify_poll_wakeup_out outarg;
M
Miklos Szeredi 已提交
1422
	int err = -EINVAL;
T
Tejun Heo 已提交
1423 1424

	if (size != sizeof(outarg))
M
Miklos Szeredi 已提交
1425
		goto err;
T
Tejun Heo 已提交
1426 1427 1428

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
M
Miklos Szeredi 已提交
1429
		goto err;
T
Tejun Heo 已提交
1430

M
Miklos Szeredi 已提交
1431
	fuse_copy_finish(cs);
T
Tejun Heo 已提交
1432
	return fuse_notify_poll_wakeup(fc, &outarg);
M
Miklos Szeredi 已提交
1433 1434 1435 1436

err:
	fuse_copy_finish(cs);
	return err;
T
Tejun Heo 已提交
1437 1438
}

J
John Muir 已提交
1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454
static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
				   struct fuse_copy_state *cs)
{
	struct fuse_notify_inval_inode_out outarg;
	int err = -EINVAL;

	if (size != sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;
	fuse_copy_finish(cs);

	down_read(&fc->killsb);
	err = -ENOENT;
1455 1456 1457 1458
	if (fc->sb) {
		err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
					       outarg.off, outarg.len);
	}
J
John Muir 已提交
1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470
	up_read(&fc->killsb);
	return err;

err:
	fuse_copy_finish(cs);
	return err;
}

static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
				   struct fuse_copy_state *cs)
{
	struct fuse_notify_inval_entry_out outarg;
F
Fang Wenqi 已提交
1471 1472
	int err = -ENOMEM;
	char *buf;
J
John Muir 已提交
1473 1474
	struct qstr name;

F
Fang Wenqi 已提交
1475 1476 1477 1478 1479
	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
	if (!buf)
		goto err;

	err = -EINVAL;
J
John Muir 已提交
1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490
	if (size < sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;

	err = -ENAMETOOLONG;
	if (outarg.namelen > FUSE_NAME_MAX)
		goto err;

1491 1492 1493 1494
	err = -EINVAL;
	if (size != sizeof(outarg) + outarg.namelen + 1)
		goto err;

J
John Muir 已提交
1495 1496 1497 1498 1499 1500 1501 1502 1503 1504
	name.name = buf;
	name.len = outarg.namelen;
	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
	if (err)
		goto err;
	fuse_copy_finish(cs);
	buf[outarg.namelen] = 0;

	down_read(&fc->killsb);
	err = -ENOENT;
1505
	if (fc->sb)
1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557
		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
	up_read(&fc->killsb);
	kfree(buf);
	return err;

err:
	kfree(buf);
	fuse_copy_finish(cs);
	return err;
}

static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
			      struct fuse_copy_state *cs)
{
	struct fuse_notify_delete_out outarg;
	int err = -ENOMEM;
	char *buf;
	struct qstr name;

	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
	if (!buf)
		goto err;

	err = -EINVAL;
	if (size < sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;

	err = -ENAMETOOLONG;
	if (outarg.namelen > FUSE_NAME_MAX)
		goto err;

	err = -EINVAL;
	if (size != sizeof(outarg) + outarg.namelen + 1)
		goto err;

	name.name = buf;
	name.len = outarg.namelen;
	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
	if (err)
		goto err;
	fuse_copy_finish(cs);
	buf[outarg.namelen] = 0;

	down_read(&fc->killsb);
	err = -ENOENT;
	if (fc->sb)
		err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
					       outarg.child, &name);
J
John Muir 已提交
1558
	up_read(&fc->killsb);
F
Fang Wenqi 已提交
1559
	kfree(buf);
J
John Muir 已提交
1560 1561 1562
	return err;

err:
F
Fang Wenqi 已提交
1563
	kfree(buf);
J
John Muir 已提交
1564 1565 1566 1567
	fuse_copy_finish(cs);
	return err;
}

M
Miklos Szeredi 已提交
1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606
static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
			     struct fuse_copy_state *cs)
{
	struct fuse_notify_store_out outarg;
	struct inode *inode;
	struct address_space *mapping;
	u64 nodeid;
	int err;
	pgoff_t index;
	unsigned int offset;
	unsigned int num;
	loff_t file_size;
	loff_t end;

	err = -EINVAL;
	if (size < sizeof(outarg))
		goto out_finish;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto out_finish;

	err = -EINVAL;
	if (size - sizeof(outarg) != outarg.size)
		goto out_finish;

	nodeid = outarg.nodeid;

	down_read(&fc->killsb);

	err = -ENOENT;
	if (!fc->sb)
		goto out_up_killsb;

	inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
	if (!inode)
		goto out_up_killsb;

	mapping = inode->i_mapping;
1607 1608
	index = outarg.offset >> PAGE_SHIFT;
	offset = outarg.offset & ~PAGE_MASK;
M
Miklos Szeredi 已提交
1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626
	file_size = i_size_read(inode);
	end = outarg.offset + outarg.size;
	if (end > file_size) {
		file_size = end;
		fuse_write_update_size(inode, file_size);
	}

	num = outarg.size;
	while (num) {
		struct page *page;
		unsigned int this_num;

		err = -ENOMEM;
		page = find_or_create_page(mapping, index,
					   mapping_gfp_mask(mapping));
		if (!page)
			goto out_iput;

1627
		this_num = min_t(unsigned, num, PAGE_SIZE - offset);
M
Miklos Szeredi 已提交
1628
		err = fuse_copy_page(cs, &page, offset, this_num, 0);
1629
		if (!err && offset == 0 &&
1630
		    (this_num == PAGE_SIZE || file_size == end))
M
Miklos Szeredi 已提交
1631 1632
			SetPageUptodate(page);
		unlock_page(page);
1633
		put_page(page);
M
Miklos Szeredi 已提交
1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653

		if (err)
			goto out_iput;

		num -= this_num;
		offset = 0;
		index++;
	}

	err = 0;

out_iput:
	iput(inode);
out_up_killsb:
	up_read(&fc->killsb);
out_finish:
	fuse_copy_finish(cs);
	return err;
}

M
Miklos Szeredi 已提交
1654 1655
static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
{
1656
	release_pages(req->pages, req->num_pages, false);
M
Miklos Szeredi 已提交
1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668
}

static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
			 struct fuse_notify_retrieve_out *outarg)
{
	int err;
	struct address_space *mapping = inode->i_mapping;
	struct fuse_req *req;
	pgoff_t index;
	loff_t file_size;
	unsigned int num;
	unsigned int offset;
1669
	size_t total_len = 0;
M
Maxim Patlasov 已提交
1670
	int num_pages;
M
Miklos Szeredi 已提交
1671

1672
	offset = outarg->offset & ~PAGE_MASK;
M
Maxim Patlasov 已提交
1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684
	file_size = i_size_read(inode);

	num = outarg->size;
	if (outarg->offset > file_size)
		num = 0;
	else if (outarg->offset + num > file_size)
		num = file_size - outarg->offset;

	num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
	num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);

	req = fuse_get_req(fc, num_pages);
M
Miklos Szeredi 已提交
1685 1686 1687 1688 1689 1690 1691
	if (IS_ERR(req))
		return PTR_ERR(req);

	req->in.h.opcode = FUSE_NOTIFY_REPLY;
	req->in.h.nodeid = outarg->nodeid;
	req->in.numargs = 2;
	req->in.argpages = 1;
1692
	req->page_descs[0].offset = offset;
M
Miklos Szeredi 已提交
1693 1694
	req->end = fuse_retrieve_end;

1695
	index = outarg->offset >> PAGE_SHIFT;
M
Miklos Szeredi 已提交
1696

M
Maxim Patlasov 已提交
1697
	while (num && req->num_pages < num_pages) {
M
Miklos Szeredi 已提交
1698 1699 1700 1701 1702 1703 1704
		struct page *page;
		unsigned int this_num;

		page = find_get_page(mapping, index);
		if (!page)
			break;

1705
		this_num = min_t(unsigned, num, PAGE_SIZE - offset);
M
Miklos Szeredi 已提交
1706
		req->pages[req->num_pages] = page;
1707
		req->page_descs[req->num_pages].length = this_num;
M
Miklos Szeredi 已提交
1708 1709
		req->num_pages++;

M
Miklos Szeredi 已提交
1710
		offset = 0;
M
Miklos Szeredi 已提交
1711 1712
		num -= this_num;
		total_len += this_num;
M
Miklos Szeredi 已提交
1713
		index++;
M
Miklos Szeredi 已提交
1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764
	}
	req->misc.retrieve_in.offset = outarg->offset;
	req->misc.retrieve_in.size = total_len;
	req->in.args[0].size = sizeof(req->misc.retrieve_in);
	req->in.args[0].value = &req->misc.retrieve_in;
	req->in.args[1].size = total_len;

	err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
	if (err)
		fuse_retrieve_end(fc, req);

	return err;
}

static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
				struct fuse_copy_state *cs)
{
	struct fuse_notify_retrieve_out outarg;
	struct inode *inode;
	int err;

	err = -EINVAL;
	if (size != sizeof(outarg))
		goto copy_finish;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto copy_finish;

	fuse_copy_finish(cs);

	down_read(&fc->killsb);
	err = -ENOENT;
	if (fc->sb) {
		u64 nodeid = outarg.nodeid;

		inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
		if (inode) {
			err = fuse_retrieve(fc, inode, &outarg);
			iput(inode);
		}
	}
	up_read(&fc->killsb);

	return err;

copy_finish:
	fuse_copy_finish(cs);
	return err;
}

1765 1766 1767
static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
		       unsigned int size, struct fuse_copy_state *cs)
{
M
Miklos Szeredi 已提交
1768 1769 1770
	/* Don't try to move pages (yet) */
	cs->move_pages = 0;

1771
	switch (code) {
T
Tejun Heo 已提交
1772 1773 1774
	case FUSE_NOTIFY_POLL:
		return fuse_notify_poll(fc, size, cs);

J
John Muir 已提交
1775 1776 1777 1778 1779 1780
	case FUSE_NOTIFY_INVAL_INODE:
		return fuse_notify_inval_inode(fc, size, cs);

	case FUSE_NOTIFY_INVAL_ENTRY:
		return fuse_notify_inval_entry(fc, size, cs);

M
Miklos Szeredi 已提交
1781 1782 1783
	case FUSE_NOTIFY_STORE:
		return fuse_notify_store(fc, size, cs);

M
Miklos Szeredi 已提交
1784 1785 1786
	case FUSE_NOTIFY_RETRIEVE:
		return fuse_notify_retrieve(fc, size, cs);

1787 1788 1789
	case FUSE_NOTIFY_DELETE:
		return fuse_notify_delete(fc, size, cs);

1790
	default:
M
Miklos Szeredi 已提交
1791
		fuse_copy_finish(cs);
1792 1793 1794 1795
		return -EINVAL;
	}
}

M
Miklos Szeredi 已提交
1796
/* Look up request on processing list by unique ID */
1797
static struct fuse_req *request_find(struct fuse_pqueue *fpq, u64 unique)
M
Miklos Szeredi 已提交
1798
{
1799
	struct fuse_req *req;
M
Miklos Szeredi 已提交
1800

1801
	list_for_each_entry(req, &fpq->processing, list) {
1802
		if (req->in.h.unique == unique || req->intr_unique == unique)
M
Miklos Szeredi 已提交
1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837
			return req;
	}
	return NULL;
}

static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
			 unsigned nbytes)
{
	unsigned reqsize = sizeof(struct fuse_out_header);

	if (out->h.error)
		return nbytes != reqsize ? -EINVAL : 0;

	reqsize += len_args(out->numargs, out->args);

	if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
		return -EINVAL;
	else if (reqsize > nbytes) {
		struct fuse_arg *lastarg = &out->args[out->numargs-1];
		unsigned diffsize = reqsize - nbytes;
		if (diffsize > lastarg->size)
			return -EINVAL;
		lastarg->size -= diffsize;
	}
	return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
			      out->page_zeroing);
}

/*
 * Write a single reply to a request.  First the header is copied from
 * the write buffer.  The request is then searched on the processing
 * list by the unique ID found in the header.  If found, then remove
 * it from the list and copy the rest of the buffer to the request.
 * The request is finished by calling request_end()
 */
1838
static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
1839
				 struct fuse_copy_state *cs, size_t nbytes)
M
Miklos Szeredi 已提交
1840 1841
{
	int err;
1842 1843
	struct fuse_conn *fc = fud->fc;
	struct fuse_pqueue *fpq = &fud->pq;
M
Miklos Szeredi 已提交
1844 1845 1846 1847 1848 1849
	struct fuse_req *req;
	struct fuse_out_header oh;

	if (nbytes < sizeof(struct fuse_out_header))
		return -EINVAL;

1850
	err = fuse_copy_one(cs, &oh, sizeof(oh));
M
Miklos Szeredi 已提交
1851 1852
	if (err)
		goto err_finish;
1853 1854 1855 1856 1857 1858 1859 1860 1861 1862

	err = -EINVAL;
	if (oh.len != nbytes)
		goto err_finish;

	/*
	 * Zero oh.unique indicates unsolicited notification message
	 * and error contains notification code.
	 */
	if (!oh.unique) {
1863
		err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1864 1865 1866
		return err ? err : nbytes;
	}

M
Miklos Szeredi 已提交
1867
	err = -EINVAL;
1868
	if (oh.error <= -1000 || oh.error > 0)
M
Miklos Szeredi 已提交
1869 1870
		goto err_finish;

M
Miklos Szeredi 已提交
1871
	spin_lock(&fpq->lock);
1872
	err = -ENOENT;
1873
	if (!fpq->connected)
M
Miklos Szeredi 已提交
1874
		goto err_unlock_pq;
1875

1876
	req = request_find(fpq, oh.unique);
M
Miklos Szeredi 已提交
1877
	if (!req)
M
Miklos Szeredi 已提交
1878
		goto err_unlock_pq;
M
Miklos Szeredi 已提交
1879

1880 1881
	/* Is it an interrupt reply? */
	if (req->intr_unique == oh.unique) {
M
Miklos Szeredi 已提交
1882 1883
		spin_unlock(&fpq->lock);

1884 1885
		err = -EINVAL;
		if (nbytes != sizeof(struct fuse_out_header))
1886
			goto err_finish;
1887 1888 1889 1890

		if (oh.error == -ENOSYS)
			fc->no_interrupt = 1;
		else if (oh.error == -EAGAIN)
M
Miklos Szeredi 已提交
1891
			queue_interrupt(&fc->iq, req);
1892

1893
		fuse_copy_finish(cs);
1894 1895 1896
		return nbytes;
	}

M
Miklos Szeredi 已提交
1897
	clear_bit(FR_SENT, &req->flags);
1898
	list_move(&req->list, &fpq->io);
M
Miklos Szeredi 已提交
1899
	req->out.h = oh;
M
Miklos Szeredi 已提交
1900
	set_bit(FR_LOCKED, &req->flags);
M
Miklos Szeredi 已提交
1901
	spin_unlock(&fpq->lock);
1902
	cs->req = req;
1903 1904
	if (!req->out.page_replace)
		cs->move_pages = 0;
M
Miklos Szeredi 已提交
1905

1906 1907
	err = copy_out_args(cs, &req->out, nbytes);
	fuse_copy_finish(cs);
M
Miklos Szeredi 已提交
1908

M
Miklos Szeredi 已提交
1909
	spin_lock(&fpq->lock);
M
Miklos Szeredi 已提交
1910
	clear_bit(FR_LOCKED, &req->flags);
1911
	if (!fpq->connected)
M
Miklos Szeredi 已提交
1912 1913
		err = -ENOENT;
	else if (err)
M
Miklos Szeredi 已提交
1914
		req->out.h.error = -EIO;
1915 1916
	if (!test_bit(FR_PRIVATE, &req->flags))
		list_del_init(&req->list);
M
Miklos Szeredi 已提交
1917
	spin_unlock(&fpq->lock);
1918

M
Miklos Szeredi 已提交
1919 1920 1921 1922
	request_end(fc, req);

	return err ? err : nbytes;

M
Miklos Szeredi 已提交
1923 1924
 err_unlock_pq:
	spin_unlock(&fpq->lock);
M
Miklos Szeredi 已提交
1925
 err_finish:
1926
	fuse_copy_finish(cs);
M
Miklos Szeredi 已提交
1927 1928 1929
	return err;
}

1930
static ssize_t fuse_dev_write(struct kiocb *iocb, struct iov_iter *from)
1931 1932
{
	struct fuse_copy_state cs;
1933 1934 1935
	struct fuse_dev *fud = fuse_get_dev(iocb->ki_filp);

	if (!fud)
1936 1937
		return -EPERM;

1938 1939 1940
	if (!iter_is_iovec(from))
		return -EINVAL;

1941
	fuse_copy_init(&cs, 0, from);
1942

1943
	return fuse_dev_do_write(fud, &cs, iov_iter_count(from));
1944 1945 1946 1947 1948 1949 1950 1951 1952 1953
}

static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
				     struct file *out, loff_t *ppos,
				     size_t len, unsigned int flags)
{
	unsigned nbuf;
	unsigned idx;
	struct pipe_buffer *bufs;
	struct fuse_copy_state cs;
1954
	struct fuse_dev *fud;
1955 1956 1957
	size_t rem;
	ssize_t ret;

1958 1959
	fud = fuse_get_dev(out);
	if (!fud)
1960 1961
		return -EPERM;

1962
	bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005
	if (!bufs)
		return -ENOMEM;

	pipe_lock(pipe);
	nbuf = 0;
	rem = 0;
	for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
		rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;

	ret = -EINVAL;
	if (rem < len) {
		pipe_unlock(pipe);
		goto out;
	}

	rem = len;
	while (rem) {
		struct pipe_buffer *ibuf;
		struct pipe_buffer *obuf;

		BUG_ON(nbuf >= pipe->buffers);
		BUG_ON(!pipe->nrbufs);
		ibuf = &pipe->bufs[pipe->curbuf];
		obuf = &bufs[nbuf];

		if (rem >= ibuf->len) {
			*obuf = *ibuf;
			ibuf->ops = NULL;
			pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
			pipe->nrbufs--;
		} else {
			ibuf->ops->get(pipe, ibuf);
			*obuf = *ibuf;
			obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
			obuf->len = rem;
			ibuf->offset += obuf->len;
			ibuf->len -= obuf->len;
		}
		nbuf++;
		rem -= obuf->len;
	}
	pipe_unlock(pipe);

2006
	fuse_copy_init(&cs, 0, NULL);
2007
	cs.pipebufs = bufs;
2008
	cs.nr_segs = nbuf;
2009 2010
	cs.pipe = pipe;

2011 2012 2013
	if (flags & SPLICE_F_MOVE)
		cs.move_pages = 1;

2014
	ret = fuse_dev_do_write(fud, &cs, len);
2015 2016 2017 2018 2019 2020 2021 2022 2023 2024

	for (idx = 0; idx < nbuf; idx++) {
		struct pipe_buffer *buf = &bufs[idx];
		buf->ops->release(pipe, buf);
	}
out:
	kfree(bufs);
	return ret;
}

M
Miklos Szeredi 已提交
2025 2026 2027
static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
{
	unsigned mask = POLLOUT | POLLWRNORM;
M
Miklos Szeredi 已提交
2028
	struct fuse_iqueue *fiq;
2029 2030 2031
	struct fuse_dev *fud = fuse_get_dev(file);

	if (!fud)
2032
		return POLLERR;
M
Miklos Szeredi 已提交
2033

2034
	fiq = &fud->fc->iq;
M
Miklos Szeredi 已提交
2035
	poll_wait(file, &fiq->waitq, wait);
M
Miklos Szeredi 已提交
2036

M
Miklos Szeredi 已提交
2037
	spin_lock(&fiq->waitq.lock);
2038
	if (!fiq->connected)
2039
		mask = POLLERR;
M
Miklos Szeredi 已提交
2040
	else if (request_pending(fiq))
2041
		mask |= POLLIN | POLLRDNORM;
M
Miklos Szeredi 已提交
2042
	spin_unlock(&fiq->waitq.lock);
M
Miklos Szeredi 已提交
2043 2044 2045 2046

	return mask;
}

2047 2048 2049
/*
 * Abort all requests on the given list (pending or processing)
 *
2050
 * This function releases and reacquires fc->lock
2051
 */
M
Miklos Szeredi 已提交
2052 2053 2054 2055 2056 2057
static void end_requests(struct fuse_conn *fc, struct list_head *head)
{
	while (!list_empty(head)) {
		struct fuse_req *req;
		req = list_entry(head->next, struct fuse_req, list);
		req->out.h.error = -ECONNABORTED;
M
Miklos Szeredi 已提交
2058 2059
		clear_bit(FR_PENDING, &req->flags);
		clear_bit(FR_SENT, &req->flags);
2060
		list_del_init(&req->list);
M
Miklos Szeredi 已提交
2061 2062 2063 2064
		request_end(fc, req);
	}
}

2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079
static void end_polls(struct fuse_conn *fc)
{
	struct rb_node *p;

	p = rb_first(&fc->polled_files);

	while (p) {
		struct fuse_file *ff;
		ff = rb_entry(p, struct fuse_file, polled_node);
		wake_up_interruptible_all(&ff->poll_wait);

		p = rb_next(p);
	}
}

2080 2081 2082
/*
 * Abort all requests.
 *
M
Miklos Szeredi 已提交
2083 2084 2085 2086 2087 2088 2089
 * Emergency exit in case of a malicious or accidental deadlock, or just a hung
 * filesystem.
 *
 * The same effect is usually achievable through killing the filesystem daemon
 * and all users of the filesystem.  The exception is the combination of an
 * asynchronous request and the tricky deadlock (see
 * Documentation/filesystems/fuse.txt).
2090
 *
M
Miklos Szeredi 已提交
2091 2092 2093 2094 2095 2096
 * Aborting requests under I/O goes as follows: 1: Separate out unlocked
 * requests, they should be finished off immediately.  Locked requests will be
 * finished after unlock; see unlock_request(). 2: Finish off the unlocked
 * requests.  It is possible that some request will finish before we can.  This
 * is OK, the request will in that case be removed from the list before we touch
 * it.
2097 2098 2099
 */
void fuse_abort_conn(struct fuse_conn *fc)
{
M
Miklos Szeredi 已提交
2100 2101
	struct fuse_iqueue *fiq = &fc->iq;

2102
	spin_lock(&fc->lock);
2103
	if (fc->connected) {
2104
		struct fuse_dev *fud;
M
Miklos Szeredi 已提交
2105
		struct fuse_req *req, *next;
M
Miklos Szeredi 已提交
2106 2107
		LIST_HEAD(to_end1);
		LIST_HEAD(to_end2);
M
Miklos Szeredi 已提交
2108

2109
		fc->connected = 0;
2110
		fc->blocked = 0;
2111
		fuse_set_initialized(fc);
2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125
		list_for_each_entry(fud, &fc->devices, entry) {
			struct fuse_pqueue *fpq = &fud->pq;

			spin_lock(&fpq->lock);
			fpq->connected = 0;
			list_for_each_entry_safe(req, next, &fpq->io, list) {
				req->out.h.error = -ECONNABORTED;
				spin_lock(&req->waitq.lock);
				set_bit(FR_ABORTED, &req->flags);
				if (!test_bit(FR_LOCKED, &req->flags)) {
					set_bit(FR_PRIVATE, &req->flags);
					list_move(&req->list, &to_end1);
				}
				spin_unlock(&req->waitq.lock);
2126
			}
2127 2128
			list_splice_init(&fpq->processing, &to_end2);
			spin_unlock(&fpq->lock);
M
Miklos Szeredi 已提交
2129
		}
M
Miklos Szeredi 已提交
2130 2131
		fc->max_background = UINT_MAX;
		flush_bg_queue(fc);
2132

M
Miklos Szeredi 已提交
2133
		spin_lock(&fiq->waitq.lock);
2134
		fiq->connected = 0;
M
Miklos Szeredi 已提交
2135
		list_splice_init(&fiq->pending, &to_end2);
2136 2137
		while (forget_pending(fiq))
			kfree(dequeue_forget(fiq, 1, NULL));
M
Miklos Szeredi 已提交
2138 2139
		wake_up_all_locked(&fiq->waitq);
		spin_unlock(&fiq->waitq.lock);
2140
		kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
2141 2142 2143
		end_polls(fc);
		wake_up_all(&fc->blocked_waitq);
		spin_unlock(&fc->lock);
2144

M
Miklos Szeredi 已提交
2145 2146
		while (!list_empty(&to_end1)) {
			req = list_first_entry(&to_end1, struct fuse_req, list);
M
Miklos Szeredi 已提交
2147
			__fuse_get_request(req);
2148
			list_del_init(&req->list);
M
Miklos Szeredi 已提交
2149 2150
			request_end(fc, req);
		}
M
Miklos Szeredi 已提交
2151
		end_requests(fc, &to_end2);
2152 2153
	} else {
		spin_unlock(&fc->lock);
2154 2155
	}
}
2156
EXPORT_SYMBOL_GPL(fuse_abort_conn);
2157

2158
int fuse_dev_release(struct inode *inode, struct file *file)
M
Miklos Szeredi 已提交
2159
{
2160 2161 2162 2163
	struct fuse_dev *fud = fuse_get_dev(file);

	if (fud) {
		struct fuse_conn *fc = fud->fc;
2164 2165 2166 2167 2168 2169 2170 2171 2172
		struct fuse_pqueue *fpq = &fud->pq;

		WARN_ON(!list_empty(&fpq->io));
		end_requests(fc, &fpq->processing);
		/* Are we the last open device? */
		if (atomic_dec_and_test(&fc->dev_count)) {
			WARN_ON(fc->iq.fasync != NULL);
			fuse_abort_conn(fc);
		}
2173
		fuse_dev_free(fud);
2174
	}
M
Miklos Szeredi 已提交
2175 2176
	return 0;
}
2177
EXPORT_SYMBOL_GPL(fuse_dev_release);
M
Miklos Szeredi 已提交
2178

2179 2180
static int fuse_dev_fasync(int fd, struct file *file, int on)
{
2181 2182 2183
	struct fuse_dev *fud = fuse_get_dev(file);

	if (!fud)
2184
		return -EPERM;
2185 2186

	/* No locking - fasync_helper does its own locking */
2187
	return fasync_helper(fd, file, on, &fud->fc->iq.fasync);
2188 2189
}

M
Miklos Szeredi 已提交
2190 2191
static int fuse_device_clone(struct fuse_conn *fc, struct file *new)
{
2192 2193
	struct fuse_dev *fud;

M
Miklos Szeredi 已提交
2194 2195 2196
	if (new->private_data)
		return -EINVAL;

2197 2198 2199 2200 2201
	fud = fuse_dev_alloc(fc);
	if (!fud)
		return -ENOMEM;

	new->private_data = fud;
2202
	atomic_inc(&fc->dev_count);
M
Miklos Szeredi 已提交
2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220

	return 0;
}

static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
			   unsigned long arg)
{
	int err = -ENOTTY;

	if (cmd == FUSE_DEV_IOC_CLONE) {
		int oldfd;

		err = -EFAULT;
		if (!get_user(oldfd, (__u32 __user *) arg)) {
			struct file *old = fget(oldfd);

			err = -EINVAL;
			if (old) {
J
Jann Horn 已提交
2221 2222 2223 2224 2225 2226 2227 2228 2229
				struct fuse_dev *fud = NULL;

				/*
				 * Check against file->f_op because CUSE
				 * uses the same ioctl handler.
				 */
				if (old->f_op == file->f_op &&
				    old->f_cred->user_ns == file->f_cred->user_ns)
					fud = fuse_get_dev(old);
M
Miklos Szeredi 已提交
2230

2231
				if (fud) {
M
Miklos Szeredi 已提交
2232
					mutex_lock(&fuse_mutex);
2233
					err = fuse_device_clone(fud->fc, file);
M
Miklos Szeredi 已提交
2234 2235 2236 2237 2238 2239 2240 2241 2242
					mutex_unlock(&fuse_mutex);
				}
				fput(old);
			}
		}
	}
	return err;
}

2243
const struct file_operations fuse_dev_operations = {
M
Miklos Szeredi 已提交
2244
	.owner		= THIS_MODULE,
2245
	.open		= fuse_dev_open,
M
Miklos Szeredi 已提交
2246
	.llseek		= no_llseek,
2247
	.read_iter	= fuse_dev_read,
2248
	.splice_read	= fuse_dev_splice_read,
2249
	.write_iter	= fuse_dev_write,
2250
	.splice_write	= fuse_dev_splice_write,
M
Miklos Szeredi 已提交
2251 2252
	.poll		= fuse_dev_poll,
	.release	= fuse_dev_release,
2253
	.fasync		= fuse_dev_fasync,
M
Miklos Szeredi 已提交
2254 2255
	.unlocked_ioctl = fuse_dev_ioctl,
	.compat_ioctl   = fuse_dev_ioctl,
M
Miklos Szeredi 已提交
2256
};
2257
EXPORT_SYMBOL_GPL(fuse_dev_operations);
M
Miklos Szeredi 已提交
2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269

static struct miscdevice fuse_miscdevice = {
	.minor = FUSE_MINOR,
	.name  = "fuse",
	.fops = &fuse_dev_operations,
};

int __init fuse_dev_init(void)
{
	int err = -ENOMEM;
	fuse_req_cachep = kmem_cache_create("fuse_request",
					    sizeof(struct fuse_req),
2270
					    0, 0, NULL);
M
Miklos Szeredi 已提交
2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290
	if (!fuse_req_cachep)
		goto out;

	err = misc_register(&fuse_miscdevice);
	if (err)
		goto out_cache_clean;

	return 0;

 out_cache_clean:
	kmem_cache_destroy(fuse_req_cachep);
 out:
	return err;
}

void fuse_dev_cleanup(void)
{
	misc_deregister(&fuse_miscdevice);
	kmem_cache_destroy(fuse_req_cachep);
}