@@ -251,17 +251,18 @@ static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
251
251
struct file * file )
252
252
{
253
253
struct fuse_req * req = NULL ;
254
+ struct fuse_inode * fi = get_fuse_inode (file_inode (file ));
254
255
struct fuse_file * ff = file -> private_data ;
255
256
256
257
do {
257
258
wait_event (fc -> reserved_req_waitq , ff -> reserved_req );
258
- spin_lock (& fc -> lock );
259
+ spin_lock (& fi -> lock );
259
260
if (ff -> reserved_req ) {
260
261
req = ff -> reserved_req ;
261
262
ff -> reserved_req = NULL ;
262
263
req -> stolen_file = get_file (file );
263
264
}
264
- spin_unlock (& fc -> lock );
265
+ spin_unlock (& fi -> lock );
265
266
} while (!req );
266
267
267
268
return req ;
@@ -273,16 +274,17 @@ static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
273
274
static void put_reserved_req (struct fuse_conn * fc , struct fuse_req * req )
274
275
{
275
276
struct file * file = req -> stolen_file ;
277
+ struct fuse_inode * fi = get_fuse_inode (file_inode (file ));
276
278
struct fuse_file * ff = file -> private_data ;
277
279
278
280
WARN_ON (req -> max_pages );
279
- spin_lock (& fc -> lock );
281
+ spin_lock (& fi -> lock );
280
282
memset (req , 0 , sizeof (* req ));
281
283
fuse_request_init (req , NULL , NULL , 0 );
282
284
BUG_ON (ff -> reserved_req );
283
285
ff -> reserved_req = req ;
284
286
wake_up_all (& fc -> reserved_req_waitq );
285
- spin_unlock (& fc -> lock );
287
+ spin_unlock (& fi -> lock );
286
288
fput (file );
287
289
}
288
290
@@ -431,10 +433,16 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
431
433
432
434
if (test_and_set_bit (FR_FINISHED , & req -> flags ))
433
435
goto put_request ;
434
-
435
- spin_lock (& fiq -> waitq .lock );
436
- list_del_init (& req -> intr_entry );
437
- spin_unlock (& fiq -> waitq .lock );
436
+ /*
437
+ * test_and_set_bit() implies smp_mb() between bit
438
+ * changing and below intr_entry check. Pairs with
439
+ * smp_mb() from queue_interrupt().
440
+ */
441
+ if (!list_empty (& req -> intr_entry )) {
442
+ spin_lock (& fiq -> waitq .lock );
443
+ list_del_init (& req -> intr_entry );
444
+ spin_unlock (& fiq -> waitq .lock );
445
+ }
438
446
WARN_ON (test_bit (FR_PENDING , & req -> flags ));
439
447
WARN_ON (test_bit (FR_SENT , & req -> flags ));
440
448
if (test_bit (FR_BACKGROUND , & req -> flags )) {
@@ -462,27 +470,43 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
462
470
fc -> active_background -- ;
463
471
flush_bg_queue (fc );
464
472
spin_unlock (& fc -> bg_lock );
473
+ } else {
474
+ /* Wake up waiter sleeping in request_wait_answer() */
475
+ wake_up (& req -> waitq );
465
476
}
466
- wake_up ( & req -> waitq );
477
+
467
478
if (req -> end )
468
479
req -> end (fc , req );
469
480
put_request :
470
481
fuse_put_request (fc , req );
471
482
}
472
483
473
- static void queue_interrupt (struct fuse_iqueue * fiq , struct fuse_req * req )
484
+ static int queue_interrupt (struct fuse_iqueue * fiq , struct fuse_req * req )
474
485
{
475
486
spin_lock (& fiq -> waitq .lock );
476
- if (test_bit (FR_FINISHED , & req -> flags )) {
487
+ /* Check for we've sent request to interrupt this req */
488
+ if (unlikely (!test_bit (FR_INTERRUPTED , & req -> flags ))) {
477
489
spin_unlock (& fiq -> waitq .lock );
478
- return ;
490
+ return - EINVAL ;
479
491
}
492
+
480
493
if (list_empty (& req -> intr_entry )) {
481
494
list_add_tail (& req -> intr_entry , & fiq -> interrupts );
495
+ /*
496
+ * Pairs with smp_mb() implied by test_and_set_bit()
497
+ * from request_end().
498
+ */
499
+ smp_mb ();
500
+ if (test_bit (FR_FINISHED , & req -> flags )) {
501
+ list_del_init (& req -> intr_entry );
502
+ spin_unlock (& fiq -> waitq .lock );
503
+ return 0 ;
504
+ }
482
505
wake_up_locked (& fiq -> waitq );
506
+ kill_fasync (& fiq -> fasync , SIGIO , POLL_IN );
483
507
}
484
508
spin_unlock (& fiq -> waitq .lock );
485
- kill_fasync ( & fiq -> fasync , SIGIO , POLL_IN ) ;
509
+ return 0 ;
486
510
}
487
511
488
512
static void request_wait_answer (struct fuse_conn * fc , struct fuse_req * req )
@@ -1306,7 +1330,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
1306
1330
goto err_unlock ;
1307
1331
1308
1332
if (!fiq -> connected ) {
1309
- err = ( fc -> aborted && fc -> abort_err ) ? - ECONNABORTED : - ENODEV ;
1333
+ err = fc -> aborted ? - ECONNABORTED : - ENODEV ;
1310
1334
goto err_unlock ;
1311
1335
}
1312
1336
@@ -1353,7 +1377,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
1353
1377
spin_lock (& fpq -> lock );
1354
1378
clear_bit (FR_LOCKED , & req -> flags );
1355
1379
if (!fpq -> connected ) {
1356
- err = ( fc -> aborted && fc -> abort_err ) ? - ECONNABORTED : - ENODEV ;
1380
+ err = fc -> aborted ? - ECONNABORTED : - ENODEV ;
1357
1381
goto out_end ;
1358
1382
}
1359
1383
if (err ) {
@@ -1900,58 +1924,58 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
1900
1924
struct fuse_req * req ;
1901
1925
struct fuse_out_header oh ;
1902
1926
1927
+ err = - EINVAL ;
1903
1928
if (nbytes < sizeof (struct fuse_out_header ))
1904
- return - EINVAL ;
1929
+ goto out ;
1905
1930
1906
1931
err = fuse_copy_one (cs , & oh , sizeof (oh ));
1907
1932
if (err )
1908
- goto err_finish ;
1933
+ goto copy_finish ;
1909
1934
1910
1935
err = - EINVAL ;
1911
1936
if (oh .len != nbytes )
1912
- goto err_finish ;
1937
+ goto copy_finish ;
1913
1938
1914
1939
/*
1915
1940
* Zero oh.unique indicates unsolicited notification message
1916
1941
* and error contains notification code.
1917
1942
*/
1918
1943
if (!oh .unique ) {
1919
1944
err = fuse_notify (fc , oh .error , nbytes - sizeof (oh ), cs );
1920
- return err ? err : nbytes ;
1945
+ goto out ;
1921
1946
}
1922
1947
1923
1948
err = - EINVAL ;
1924
1949
if (oh .error <= -1000 || oh .error > 0 )
1925
- goto err_finish ;
1950
+ goto copy_finish ;
1926
1951
1927
1952
spin_lock (& fpq -> lock );
1928
- err = - ENOENT ;
1929
- if (! fpq -> connected )
1930
- goto err_unlock_pq ;
1953
+ req = NULL ;
1954
+ if (fpq -> connected )
1955
+ req = request_find ( fpq , oh . unique & ~ FUSE_INT_REQ_BIT ) ;
1931
1956
1932
- req = request_find (fpq , oh .unique & ~FUSE_INT_REQ_BIT );
1933
- if (!req )
1934
- goto err_unlock_pq ;
1957
+ err = - ENOENT ;
1958
+ if (!req ) {
1959
+ spin_unlock (& fpq -> lock );
1960
+ goto copy_finish ;
1961
+ }
1935
1962
1936
1963
/* Is it an interrupt reply ID? */
1937
1964
if (oh .unique & FUSE_INT_REQ_BIT ) {
1938
1965
__fuse_get_request (req );
1939
1966
spin_unlock (& fpq -> lock );
1940
1967
1941
- err = - EINVAL ;
1942
- if (nbytes != sizeof (struct fuse_out_header )) {
1943
- fuse_put_request (fc , req );
1944
- goto err_finish ;
1945
- }
1946
-
1947
- if (oh .error == - ENOSYS )
1968
+ err = 0 ;
1969
+ if (nbytes != sizeof (struct fuse_out_header ))
1970
+ err = - EINVAL ;
1971
+ else if (oh .error == - ENOSYS )
1948
1972
fc -> no_interrupt = 1 ;
1949
1973
else if (oh .error == - EAGAIN )
1950
- queue_interrupt (& fc -> iq , req );
1974
+ err = queue_interrupt (& fc -> iq , req );
1975
+
1951
1976
fuse_put_request (fc , req );
1952
1977
1953
- fuse_copy_finish (cs );
1954
- return nbytes ;
1978
+ goto copy_finish ;
1955
1979
}
1956
1980
1957
1981
clear_bit (FR_SENT , & req -> flags );
@@ -1977,14 +2001,12 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
1977
2001
spin_unlock (& fpq -> lock );
1978
2002
1979
2003
request_end (fc , req );
1980
-
2004
+ out :
1981
2005
return err ? err : nbytes ;
1982
2006
1983
- err_unlock_pq :
1984
- spin_unlock (& fpq -> lock );
1985
- err_finish :
2007
+ copy_finish :
1986
2008
fuse_copy_finish (cs );
1987
- return err ;
2009
+ goto out ;
1988
2010
}
1989
2011
1990
2012
static ssize_t fuse_dev_write (struct kiocb * iocb , struct iov_iter * from )
@@ -2109,11 +2131,7 @@ static __poll_t fuse_dev_poll(struct file *file, poll_table *wait)
2109
2131
return mask ;
2110
2132
}
2111
2133
2112
- /*
2113
- * Abort all requests on the given list (pending or processing)
2114
- *
2115
- * This function releases and reacquires fc->lock
2116
- */
2134
+ /* Abort all requests on the given list (pending or processing) */
2117
2135
static void end_requests (struct fuse_conn * fc , struct list_head * head )
2118
2136
{
2119
2137
while (!list_empty (head )) {
@@ -2159,7 +2177,7 @@ static void end_polls(struct fuse_conn *fc)
2159
2177
* is OK, the request will in that case be removed from the list before we touch
2160
2178
* it.
2161
2179
*/
2162
- void fuse_abort_conn (struct fuse_conn * fc , bool is_abort )
2180
+ void fuse_abort_conn (struct fuse_conn * fc )
2163
2181
{
2164
2182
struct fuse_iqueue * fiq = & fc -> iq ;
2165
2183
@@ -2175,7 +2193,6 @@ void fuse_abort_conn(struct fuse_conn *fc, bool is_abort)
2175
2193
fc -> connected = 0 ;
2176
2194
spin_unlock (& fc -> bg_lock );
2177
2195
2178
- fc -> aborted = is_abort ;
2179
2196
fuse_set_initialized (fc );
2180
2197
list_for_each_entry (fud , & fc -> devices , entry ) {
2181
2198
struct fuse_pqueue * fpq = & fud -> pq ;
@@ -2253,7 +2270,7 @@ int fuse_dev_release(struct inode *inode, struct file *file)
2253
2270
/* Are we the last open device? */
2254
2271
if (atomic_dec_and_test (& fc -> dev_count )) {
2255
2272
WARN_ON (fc -> iq .fasync != NULL );
2256
- fuse_abort_conn (fc , false );
2273
+ fuse_abort_conn (fc );
2257
2274
}
2258
2275
fuse_dev_free (fud );
2259
2276
}
0 commit comments