?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / fs / fuse / dev.c
blob8142f6bf3d310b1e1fe8573d7642ac2951961cad
1 /*
2 FUSE: Filesystem in Userspace
3 Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
4
5 This program can be distributed under the terms of the GNU GPL.
6 See the file COPYING.
7 */
8
9 #include "fuse_i.h"
10
11 #include <linux/init.h>
12 #include <linux/module.h>
13 #include <linux/poll.h>
14 #include <linux/uio.h>
15 #include <linux/miscdevice.h>
16 #include <linux/pagemap.h>
17 #include <linux/file.h>
18 #include <linux/slab.h>
19 #include <linux/pipe_fs_i.h>
20 #include <linux/swap.h>
21 #include <linux/splice.h>
22
23 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
24 MODULE_ALIAS("devname:fuse");
25
26 static struct kmem_cache *fuse_req_cachep;
27
28 static struct fuse_dev *fuse_get_dev(struct file *file)
29 {
30 /*
31 * Lockless access is OK, because file->private data is set
32 * once during mount and is valid until the file is released.
33 */
34 return ACCESS_ONCE(file->private_data);
35 }
36
37 static void fuse_request_init(struct fuse_req *req, struct page **pages,
38 struct fuse_page_desc *page_descs,
39 unsigned npages)
40 {
41 memset(req, 0, sizeof(*req));
42 memset(pages, 0, sizeof(*pages) * npages);
43 memset(page_descs, 0, sizeof(*page_descs) * npages);
44 INIT_LIST_HEAD(&req->list);
45 INIT_LIST_HEAD(&req->intr_entry);
46 init_waitqueue_head(&req->waitq);
47 atomic_set(&req->count, 1);
48 req->pages = pages;
49 req->page_descs = page_descs;
50 req->max_pages = npages;
51 __set_bit(FR_PENDING, &req->flags);
52 }
53
54 static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
55 {
56 struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
57 if (req) {
58 struct page **pages;
59 struct fuse_page_desc *page_descs;
60
61 if (npages <= FUSE_REQ_INLINE_PAGES) {
62 pages = req->inline_pages;
63 page_descs = req->inline_page_descs;
64 } else {
65 pages = kmalloc(sizeof(struct page *) * npages, flags);
66 page_descs = kmalloc(sizeof(struct fuse_page_desc) *
67 npages, flags);
68 }
69
70 if (!pages || !page_descs) {
71 kfree(pages);
72 kfree(page_descs);
73 kmem_cache_free(fuse_req_cachep, req);
74 return NULL;
75 }
76
77 fuse_request_init(req, pages, page_descs, npages);
78 }
79 return req;
80 }
81
82 struct fuse_req *fuse_request_alloc(unsigned npages)
83 {
84 return __fuse_request_alloc(npages, GFP_KERNEL);
85 }
86 EXPORT_SYMBOL_GPL(fuse_request_alloc);
87
88 struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
89 {
90 return __fuse_request_alloc(npages, GFP_NOFS);
91 }
92
93 void fuse_request_free(struct fuse_req *req)
94 {
95 if (req->pages != req->inline_pages) {
96 kfree(req->pages);
97 kfree(req->page_descs);
98 }
99 kmem_cache_free(fuse_req_cachep, req);
100 }
101
102 static void block_sigs(sigset_t *oldset)
103 {
104 sigset_t mask;
105
106 siginitsetinv(&mask, sigmask(SIGKILL));
107 sigprocmask(SIG_BLOCK, &mask, oldset);
108 }
109
110 static void restore_sigs(sigset_t *oldset)
111 {
112 sigprocmask(SIG_SETMASK, oldset, NULL);
113 }
114
115 void __fuse_get_request(struct fuse_req *req)
116 {
117 atomic_inc(&req->count);
118 }
119
120 /* Must be called with > 1 refcount */
121 static void __fuse_put_request(struct fuse_req *req)
122 {
123 BUG_ON(atomic_read(&req->count) < 2);
124 atomic_dec(&req->count);
125 }
126
127 static void fuse_req_init_context(struct fuse_req *req)
128 {
129 req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
130 req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
131 req->in.h.pid = current->pid;
132 }
133
134 void fuse_set_initialized(struct fuse_conn *fc)
135 {
136 /* Make sure stores before this are seen on another CPU */
137 smp_wmb();
138 fc->initialized = 1;
139 }
140
141 static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
142 {
143 return !fc->initialized || (for_background && fc->blocked);
144 }
145
146 static void fuse_drop_waiting(struct fuse_conn *fc)
147 {
148 /*
149 * lockess check of fc->connected is okay, because atomic_dec_and_test()
150 * provides a memory barrier mached with the one in fuse_wait_aborted()
151 * to ensure no wake-up is missed.
152 */
153 if (atomic_dec_and_test(&fc->num_waiting) &&
154 !READ_ONCE(fc->connected)) {
155 /* wake up aborters */
156 wake_up_all(&fc->blocked_waitq);
157 }
158 }
159
160 static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
161 bool for_background)
162 {
163 struct fuse_req *req;
164 int err;
165 atomic_inc(&fc->num_waiting);
166
167 if (fuse_block_alloc(fc, for_background)) {
168 sigset_t oldset;
169 int intr;
170
171 block_sigs(&oldset);
172 intr = wait_event_interruptible_exclusive(fc->blocked_waitq,
173 !fuse_block_alloc(fc, for_background));
174 restore_sigs(&oldset);
175 err = -EINTR;
176 if (intr)
177 goto out;
178 }
179 /* Matches smp_wmb() in fuse_set_initialized() */
180 smp_rmb();
181
182 err = -ENOTCONN;
183 if (!fc->connected)
184 goto out;
185
186 err = -ECONNREFUSED;
187 if (fc->conn_error)
188 goto out;
189
190 req = fuse_request_alloc(npages);
191 err = -ENOMEM;
192 if (!req) {
193 if (for_background)
194 wake_up(&fc->blocked_waitq);
195 goto out;
196 }
197
198 fuse_req_init_context(req);
199 __set_bit(FR_WAITING, &req->flags);
200 if (for_background)
201 __set_bit(FR_BACKGROUND, &req->flags);
202
203 return req;
204
205 out:
206 fuse_drop_waiting(fc);
207 return ERR_PTR(err);
208 }
209
210 struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
211 {
212 return __fuse_get_req(fc, npages, false);
213 }
214 EXPORT_SYMBOL_GPL(fuse_get_req);
215
216 struct fuse_req *fuse_get_req_for_background(struct fuse_conn *fc,
217 unsigned npages)
218 {
219 return __fuse_get_req(fc, npages, true);
220 }
221 EXPORT_SYMBOL_GPL(fuse_get_req_for_background);
222
223 /*
224 * Return request in fuse_file->reserved_req. However that may
225 * currently be in use. If that is the case, wait for it to become
226 * available.
227 */
228 static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
229 struct file *file)
230 {
231 struct fuse_req *req = NULL;
232 struct fuse_file *ff = file->private_data;
233
234 do {
235 wait_event(fc->reserved_req_waitq, ff->reserved_req);
236 spin_lock(&fc->lock);
237 if (ff->reserved_req) {
238 req = ff->reserved_req;
239 ff->reserved_req = NULL;
240 req->stolen_file = get_file(file);
241 }
242 spin_unlock(&fc->lock);
243 } while (!req);
244
245 return req;
246 }
247
248 /*
249 * Put stolen request back into fuse_file->reserved_req
250 */
251 static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
252 {
253 struct file *file = req->stolen_file;
254 struct fuse_file *ff = file->private_data;
255
256 spin_lock(&fc->lock);
257 fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
258 BUG_ON(ff->reserved_req);
259 ff->reserved_req = req;
260 wake_up_all(&fc->reserved_req_waitq);
261 spin_unlock(&fc->lock);
262 fput(file);
263 }
264
265 /*
266 * Gets a requests for a file operation, always succeeds
267 *
268 * This is used for sending the FLUSH request, which must get to
269 * userspace, due to POSIX locks which may need to be unlocked.
270 *
271 * If allocation fails due to OOM, use the reserved request in
272 * fuse_file.
273 *
274 * This is very unlikely to deadlock accidentally, since the
275 * filesystem should not have it's own file open. If deadlock is
276 * intentional, it can still be broken by "aborting" the filesystem.
277 */
278 struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
279 struct file *file)
280 {
281 struct fuse_req *req;
282
283 atomic_inc(&fc->num_waiting);
284 wait_event(fc->blocked_waitq, fc->initialized);
285 /* Matches smp_wmb() in fuse_set_initialized() */
286 smp_rmb();
287 req = fuse_request_alloc(0);
288 if (!req)
289 req = get_reserved_req(fc, file);
290
291 fuse_req_init_context(req);
292 __set_bit(FR_WAITING, &req->flags);
293 __clear_bit(FR_BACKGROUND, &req->flags);
294 return req;
295 }
296
297 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
298 {
299 if (atomic_dec_and_test(&req->count)) {
300 if (test_bit(FR_BACKGROUND, &req->flags)) {
301 /*
302 * We get here in the unlikely case that a background
303 * request was allocated but not sent
304 */
305 spin_lock(&fc->lock);
306 if (!fc->blocked)
307 wake_up(&fc->blocked_waitq);
308 spin_unlock(&fc->lock);
309 }
310
311 if (test_bit(FR_WAITING, &req->flags)) {
312 __clear_bit(FR_WAITING, &req->flags);
313 fuse_drop_waiting(fc);
314 }
315
316 if (req->stolen_file)
317 put_reserved_req(fc, req);
318 else
319 fuse_request_free(req);
320 }
321 }
322 EXPORT_SYMBOL_GPL(fuse_put_request);
323
324 static unsigned len_args(unsigned numargs, struct fuse_arg *args)
325 {
326 unsigned nbytes = 0;
327 unsigned i;
328
329 for (i = 0; i < numargs; i++)
330 nbytes += args[i].size;
331
332 return nbytes;
333 }
334
335 static u64 fuse_get_unique(struct fuse_iqueue *fiq)
336 {
337 return ++fiq->reqctr;
338 }
339
340 static void queue_request(struct fuse_iqueue *fiq, struct fuse_req *req)
341 {
342 req->in.h.len = sizeof(struct fuse_in_header) +
343 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
344 list_add_tail(&req->list, &fiq->pending);
345 wake_up_locked(&fiq->waitq);
346 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
347 }
348
349 void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
350 u64 nodeid, u64 nlookup)
351 {
352 struct fuse_iqueue *fiq = &fc->iq;
353
354 forget->forget_one.nodeid = nodeid;
355 forget->forget_one.nlookup = nlookup;
356
357 spin_lock(&fiq->waitq.lock);
358 if (fiq->connected) {
359 fiq->forget_list_tail->next = forget;
360 fiq->forget_list_tail = forget;
361 wake_up_locked(&fiq->waitq);
362 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
363 } else {
364 kfree(forget);
365 }
366 spin_unlock(&fiq->waitq.lock);
367 }
368
369 static void flush_bg_queue(struct fuse_conn *fc)
370 {
371 while (fc->active_background < fc->max_background &&
372 !list_empty(&fc->bg_queue)) {
373 struct fuse_req *req;
374 struct fuse_iqueue *fiq = &fc->iq;
375
376 req = list_entry(fc->bg_queue.next, struct fuse_req, list);
377 list_del(&req->list);
378 fc->active_background++;
379 spin_lock(&fiq->waitq.lock);
380 req->in.h.unique = fuse_get_unique(fiq);
381 queue_request(fiq, req);
382 spin_unlock(&fiq->waitq.lock);
383 }
384 }
385
386 /*
387 * This function is called when a request is finished. Either a reply
388 * has arrived or it was aborted (and not yet sent) or some error
389 * occurred during communication with userspace, or the device file
390 * was closed. The requester thread is woken up (if still waiting),
391 * the 'end' callback is called if given, else the reference to the
392 * request is released
393 */
394 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
395 {
396 struct fuse_iqueue *fiq = &fc->iq;
397
398 if (test_and_set_bit(FR_FINISHED, &req->flags))
399 goto put_request;
400
401 spin_lock(&fiq->waitq.lock);
402 list_del_init(&req->intr_entry);
403 spin_unlock(&fiq->waitq.lock);
404 WARN_ON(test_bit(FR_PENDING, &req->flags));
405 WARN_ON(test_bit(FR_SENT, &req->flags));
406 if (test_bit(FR_BACKGROUND, &req->flags)) {
407 spin_lock(&fc->lock);
408 clear_bit(FR_BACKGROUND, &req->flags);
409 if (fc->num_background == fc->max_background) {
410 fc->blocked = 0;
411 wake_up(&fc->blocked_waitq);
412 } else if (!fc->blocked) {
413 /*
414 * Wake up next waiter, if any. It's okay to use
415 * waitqueue_active(), as we've already synced up
416 * fc->blocked with waiters with the wake_up() call
417 * above.
418 */
419 if (waitqueue_active(&fc->blocked_waitq))
420 wake_up(&fc->blocked_waitq);
421 }
422
423 if (fc->num_background == fc->congestion_threshold &&
424 fc->connected && fc->bdi_initialized) {
425 clear_bdi_congested(&fc->bdi, BLK_RW_SYNC);
426 clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
427 }
428 fc->num_background--;
429 fc->active_background--;
430 flush_bg_queue(fc);
431 spin_unlock(&fc->lock);
432 }
433 wake_up(&req->waitq);
434 if (req->end)
435 req->end(fc, req);
436 put_request:
437 fuse_put_request(fc, req);
438 }
439
440 static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)
441 {
442 spin_lock(&fiq->waitq.lock);
443 if (test_bit(FR_FINISHED, &req->flags)) {
444 spin_unlock(&fiq->waitq.lock);
445 return;
446 }
447 if (list_empty(&req->intr_entry)) {
448 list_add_tail(&req->intr_entry, &fiq->interrupts);
449 wake_up_locked(&fiq->waitq);
450 }
451 spin_unlock(&fiq->waitq.lock);
452 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
453 }
454
455 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
456 {
457 struct fuse_iqueue *fiq = &fc->iq;
458 int err;
459
460 if (!fc->no_interrupt) {
461 /* Any signal may interrupt this */
462 err = wait_event_interruptible(req->waitq,
463 test_bit(FR_FINISHED, &req->flags));
464 if (!err)
465 return;
466
467 set_bit(FR_INTERRUPTED, &req->flags);
468 /* matches barrier in fuse_dev_do_read() */
469 smp_mb__after_atomic();
470 if (test_bit(FR_SENT, &req->flags))
471 queue_interrupt(fiq, req);
472 }
473
474 if (!test_bit(FR_FORCE, &req->flags)) {
475 sigset_t oldset;
476
477 /* Only fatal signals may interrupt this */
478 block_sigs(&oldset);
479 err = wait_event_interruptible(req->waitq,
480 test_bit(FR_FINISHED, &req->flags));
481 restore_sigs(&oldset);
482
483 if (!err)
484 return;
485
486 spin_lock(&fiq->waitq.lock);
487 /* Request is not yet in userspace, bail out */
488 if (test_bit(FR_PENDING, &req->flags)) {
489 list_del(&req->list);
490 spin_unlock(&fiq->waitq.lock);
491 __fuse_put_request(req);
492 req->out.h.error = -EINTR;
493 return;
494 }
495 spin_unlock(&fiq->waitq.lock);
496 }
497
498 /*
499 * Either request is already in userspace, or it was forced.
500 * Wait it out.
501 */
502 wait_event(req->waitq, test_bit(FR_FINISHED, &req->flags));
503 }
504
505 static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
506 {
507 struct fuse_iqueue *fiq = &fc->iq;
508
509 BUG_ON(test_bit(FR_BACKGROUND, &req->flags));
510 spin_lock(&fiq->waitq.lock);
511 if (!fiq->connected) {
512 spin_unlock(&fiq->waitq.lock);
513 req->out.h.error = -ENOTCONN;
514 } else {
515 req->in.h.unique = fuse_get_unique(fiq);
516 queue_request(fiq, req);
517 /* acquire extra reference, since request is still needed
518 after request_end() */
519 __fuse_get_request(req);
520 spin_unlock(&fiq->waitq.lock);
521
522 request_wait_answer(fc, req);
523 /* Pairs with smp_wmb() in request_end() */
524 smp_rmb();
525 }
526 }
527
528 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
529 {
530 __set_bit(FR_ISREPLY, &req->flags);
531 if (!test_bit(FR_WAITING, &req->flags)) {
532 __set_bit(FR_WAITING, &req->flags);
533 atomic_inc(&fc->num_waiting);
534 }
535 __fuse_request_send(fc, req);
536 }
537 EXPORT_SYMBOL_GPL(fuse_request_send);
538
539 static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args)
540 {
541 if (fc->minor < 4 && args->in.h.opcode == FUSE_STATFS)
542 args->out.args[0].size = FUSE_COMPAT_STATFS_SIZE;
543
544 if (fc->minor < 9) {
545 switch (args->in.h.opcode) {
546 case FUSE_LOOKUP:
547 case FUSE_CREATE:
548 case FUSE_MKNOD:
549 case FUSE_MKDIR:
550 case FUSE_SYMLINK:
551 case FUSE_LINK:
552 args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
553 break;
554 case FUSE_GETATTR:
555 case FUSE_SETATTR:
556 args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
557 break;
558 }
559 }
560 if (fc->minor < 12) {
561 switch (args->in.h.opcode) {
562 case FUSE_CREATE:
563 args->in.args[0].size = sizeof(struct fuse_open_in);
564 break;
565 case FUSE_MKNOD:
566 args->in.args[0].size = FUSE_COMPAT_MKNOD_IN_SIZE;
567 break;
568 }
569 }
570 }
571
572 ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
573 {
574 struct fuse_req *req;
575 ssize_t ret;
576
577 req = fuse_get_req(fc, 0);
578 if (IS_ERR(req))
579 return PTR_ERR(req);
580
581 /* Needs to be done after fuse_get_req() so that fc->minor is valid */
582 fuse_adjust_compat(fc, args);
583
584 req->in.h.opcode = args->in.h.opcode;
585 req->in.h.nodeid = args->in.h.nodeid;
586 req->in.numargs = args->in.numargs;
587 memcpy(req->in.args, args->in.args,
588 args->in.numargs * sizeof(struct fuse_in_arg));
589 req->out.argvar = args->out.argvar;
590 req->out.numargs = args->out.numargs;
591 memcpy(req->out.args, args->out.args,
592 args->out.numargs * sizeof(struct fuse_arg));
593 fuse_request_send(fc, req);
594 ret = req->out.h.error;
595 if (!ret && args->out.argvar) {
596 BUG_ON(args->out.numargs != 1);
597 ret = req->out.args[0].size;
598 }
599 fuse_put_request(fc, req);
600
601 return ret;
602 }
603
604 /*
605 * Called under fc->lock
606 *
607 * fc->connected must have been checked previously
608 */
609 void fuse_request_send_background_locked(struct fuse_conn *fc,
610 struct fuse_req *req)
611 {
612 BUG_ON(!test_bit(FR_BACKGROUND, &req->flags));
613 if (!test_bit(FR_WAITING, &req->flags)) {
614 __set_bit(FR_WAITING, &req->flags);
615 atomic_inc(&fc->num_waiting);
616 }
617 __set_bit(FR_ISREPLY, &req->flags);
618 fc->num_background++;
619 if (fc->num_background == fc->max_background)
620 fc->blocked = 1;
621 if (fc->num_background == fc->congestion_threshold &&
622 fc->bdi_initialized) {
623 set_bdi_congested(&fc->bdi, BLK_RW_SYNC);
624 set_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
625 }
626 list_add_tail(&req->list, &fc->bg_queue);
627 flush_bg_queue(fc);
628 }
629
630 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
631 {
632 BUG_ON(!req->end);
633 spin_lock(&fc->lock);
634 if (fc->connected) {
635 fuse_request_send_background_locked(fc, req);
636 spin_unlock(&fc->lock);
637 } else {
638 spin_unlock(&fc->lock);
639 req->out.h.error = -ENOTCONN;
640 req->end(fc, req);
641 fuse_put_request(fc, req);
642 }
643 }
644 EXPORT_SYMBOL_GPL(fuse_request_send_background);
645
646 static int fuse_request_send_notify_reply(struct fuse_conn *fc,
647 struct fuse_req *req, u64 unique)
648 {
649 int err = -ENODEV;
650 struct fuse_iqueue *fiq = &fc->iq;
651
652 __clear_bit(FR_ISREPLY, &req->flags);
653 req->in.h.unique = unique;
654 spin_lock(&fiq->waitq.lock);
655 if (fiq->connected) {
656 queue_request(fiq, req);
657 err = 0;
658 }
659 spin_unlock(&fiq->waitq.lock);
660
661 return err;
662 }
663
664 void fuse_force_forget(struct file *file, u64 nodeid)
665 {
666 struct inode *inode = file_inode(file);
667 struct fuse_conn *fc = get_fuse_conn(inode);
668 struct fuse_req *req;
669 struct fuse_forget_in inarg;
670
671 memset(&inarg, 0, sizeof(inarg));
672 inarg.nlookup = 1;
673 req = fuse_get_req_nofail_nopages(fc, file);
674 req->in.h.opcode = FUSE_FORGET;
675 req->in.h.nodeid = nodeid;
676 req->in.numargs = 1;
677 req->in.args[0].size = sizeof(inarg);
678 req->in.args[0].value = &inarg;
679 __clear_bit(FR_ISREPLY, &req->flags);
680 __fuse_request_send(fc, req);
681 /* ignore errors */
682 fuse_put_request(fc, req);
683 }
684
685 /*
686 * Lock the request. Up to the next unlock_request() there mustn't be
687 * anything that could cause a page-fault. If the request was already
688 * aborted bail out.
689 */
690 static int lock_request(struct fuse_req *req)
691 {
692 int err = 0;
693 if (req) {
694 spin_lock(&req->waitq.lock);
695 if (test_bit(FR_ABORTED, &req->flags))
696 err = -ENOENT;
697 else
698 set_bit(FR_LOCKED, &req->flags);
699 spin_unlock(&req->waitq.lock);
700 }
701 return err;
702 }
703
704 /*
705 * Unlock request. If it was aborted while locked, caller is responsible
706 * for unlocking and ending the request.
707 */
708 static int unlock_request(struct fuse_req *req)
709 {
710 int err = 0;
711 if (req) {
712 spin_lock(&req->waitq.lock);
713 if (test_bit(FR_ABORTED, &req->flags))
714 err = -ENOENT;
715 else
716 clear_bit(FR_LOCKED, &req->flags);
717 spin_unlock(&req->waitq.lock);
718 }
719 return err;
720 }
721
722 struct fuse_copy_state {
723 int write;
724 struct fuse_req *req;
725 struct iov_iter *iter;
726 struct pipe_buffer *pipebufs;
727 struct pipe_buffer *currbuf;
728 struct pipe_inode_info *pipe;
729 unsigned long nr_segs;
730 struct page *pg;
731 unsigned len;
732 unsigned offset;
733 unsigned move_pages:1;
734 };
735
736 static void fuse_copy_init(struct fuse_copy_state *cs, int write,
737 struct iov_iter *iter)
738 {
739 memset(cs, 0, sizeof(*cs));
740 cs->write = write;
741 cs->iter = iter;
742 }
743
744 /* Unmap and put previous page of userspace buffer */
745 static void fuse_copy_finish(struct fuse_copy_state *cs)
746 {
747 if (cs->currbuf) {
748 struct pipe_buffer *buf = cs->currbuf;
749
750 if (cs->write)
751 buf->len = PAGE_SIZE - cs->len;
752 cs->currbuf = NULL;
753 } else if (cs->pg) {
754 if (cs->write) {
755 flush_dcache_page(cs->pg);
756 set_page_dirty_lock(cs->pg);
757 }
758 put_page(cs->pg);
759 }
760 cs->pg = NULL;
761 }
762
763 /*
764 * Get another pagefull of userspace buffer, and map it to kernel
765 * address space, and lock request
766 */
767 static int fuse_copy_fill(struct fuse_copy_state *cs)
768 {
769 struct page *page;
770 int err;
771
772 err = unlock_request(cs->req);
773 if (err)
774 return err;
775
776 fuse_copy_finish(cs);
777 if (cs->pipebufs) {
778 struct pipe_buffer *buf = cs->pipebufs;
779
780 if (!cs->write) {
781 err = buf->ops->confirm(cs->pipe, buf);
782 if (err)
783 return err;
784
785 BUG_ON(!cs->nr_segs);
786 cs->currbuf = buf;
787 cs->pg = buf->page;
788 cs->offset = buf->offset;
789 cs->len = buf->len;
790 cs->pipebufs++;
791 cs->nr_segs--;
792 } else {
793 if (cs->nr_segs == cs->pipe->buffers)
794 return -EIO;
795
796 page = alloc_page(GFP_HIGHUSER);
797 if (!page)
798 return -ENOMEM;
799
800 buf->page = page;
801 buf->offset = 0;
802 buf->len = 0;
803
804 cs->currbuf = buf;
805 cs->pg = page;
806 cs->offset = 0;
807 cs->len = PAGE_SIZE;
808 cs->pipebufs++;
809 cs->nr_segs++;
810 }
811 } else {
812 size_t off;
813 err = iov_iter_get_pages(cs->iter, &page, PAGE_SIZE, 1, &off);
814 if (err < 0)
815 return err;
816 BUG_ON(!err);
817 cs->len = err;
818 cs->offset = off;
819 cs->pg = page;
820 cs->offset = off;
821 iov_iter_advance(cs->iter, err);
822 }
823
824 return lock_request(cs->req);
825 }
826
827 /* Do as much copy to/from userspace buffer as we can */
828 static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
829 {
830 unsigned ncpy = min(*size, cs->len);
831 if (val) {
832 void *pgaddr = kmap_atomic(cs->pg);
833 void *buf = pgaddr + cs->offset;
834
835 if (cs->write)
836 memcpy(buf, *val, ncpy);
837 else
838 memcpy(*val, buf, ncpy);
839
840 kunmap_atomic(pgaddr);
841 *val += ncpy;
842 }
843 *size -= ncpy;
844 cs->len -= ncpy;
845 cs->offset += ncpy;
846 return ncpy;
847 }
848
849 static int fuse_check_page(struct page *page)
850 {
851 if (page_mapcount(page) ||
852 page->mapping != NULL ||
853 page_count(page) != 1 ||
854 (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
855 ~(1 << PG_locked |
856 1 << PG_referenced |
857 1 << PG_uptodate |
858 1 << PG_lru |
859 1 << PG_active |
860 1 << PG_reclaim))) {
861 printk(KERN_WARNING "fuse: trying to steal weird page\n");
862 printk(KERN_WARNING " page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
863 return 1;
864 }
865 return 0;
866 }
867
868 static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
869 {
870 int err;
871 struct page *oldpage = *pagep;
872 struct page *newpage;
873 struct pipe_buffer *buf = cs->pipebufs;
874
875 err = unlock_request(cs->req);
876 if (err)
877 return err;
878
879 fuse_copy_finish(cs);
880
881 err = buf->ops->confirm(cs->pipe, buf);
882 if (err)
883 return err;
884
885 BUG_ON(!cs->nr_segs);
886 cs->currbuf = buf;
887 cs->len = buf->len;
888 cs->pipebufs++;
889 cs->nr_segs--;
890
891 if (cs->len != PAGE_SIZE)
892 goto out_fallback;
893
894 if (buf->ops->steal(cs->pipe, buf) != 0)
895 goto out_fallback;
896
897 newpage = buf->page;
898
899 if (!PageUptodate(newpage))
900 SetPageUptodate(newpage);
901
902 ClearPageMappedToDisk(newpage);
903
904 if (fuse_check_page(newpage) != 0)
905 goto out_fallback_unlock;
906
907 /*
908 * This is a new and locked page, it shouldn't be mapped or
909 * have any special flags on it
910 */
911 if (WARN_ON(page_mapped(oldpage)))
912 goto out_fallback_unlock;
913 if (WARN_ON(page_has_private(oldpage)))
914 goto out_fallback_unlock;
915 if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
916 goto out_fallback_unlock;
917 if (WARN_ON(PageMlocked(oldpage)))
918 goto out_fallback_unlock;
919
920 err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
921 if (err) {
922 unlock_page(newpage);
923 return err;
924 }
925
926 page_cache_get(newpage);
927
928 if (!(buf->flags & PIPE_BUF_FLAG_LRU))
929 lru_cache_add_file(newpage);
930
931 err = 0;
932 spin_lock(&cs->req->waitq.lock);
933 if (test_bit(FR_ABORTED, &cs->req->flags))
934 err = -ENOENT;
935 else
936 *pagep = newpage;
937 spin_unlock(&cs->req->waitq.lock);
938
939 if (err) {
940 unlock_page(newpage);
941 page_cache_release(newpage);
942 return err;
943 }
944
945 unlock_page(oldpage);
946 page_cache_release(oldpage);
947 cs->len = 0;
948
949 return 0;
950
951 out_fallback_unlock:
952 unlock_page(newpage);
953 out_fallback:
954 cs->pg = buf->page;
955 cs->offset = buf->offset;
956
957 err = lock_request(cs->req);
958 if (err)
959 return err;
960
961 return 1;
962 }
963
964 static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
965 unsigned offset, unsigned count)
966 {
967 struct pipe_buffer *buf;
968 int err;
969
970 if (cs->nr_segs == cs->pipe->buffers)
971 return -EIO;
972
973 err = unlock_request(cs->req);
974 if (err)
975 return err;
976
977 fuse_copy_finish(cs);
978
979 buf = cs->pipebufs;
980 page_cache_get(page);
981 buf->page = page;
982 buf->offset = offset;
983 buf->len = count;
984
985 cs->pipebufs++;
986 cs->nr_segs++;
987 cs->len = 0;
988
989 return 0;
990 }
991
992 /*
993 * Copy a page in the request to/from the userspace buffer. Must be
994 * done atomically
995 */
996 static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
997 unsigned offset, unsigned count, int zeroing)
998 {
999 int err;
1000 struct page *page = *pagep;
1001
1002 if (page && zeroing && count < PAGE_SIZE)
1003 clear_highpage(page);
1004
1005 while (count) {
1006 if (cs->write && cs->pipebufs && page) {
1007 return fuse_ref_page(cs, page, offset, count);
1008 } else if (!cs->len) {
1009 if (cs->move_pages && page &&
1010 offset == 0 && count == PAGE_SIZE) {
1011 err = fuse_try_move_page(cs, pagep);
1012 if (err <= 0)
1013 return err;
1014 } else {
1015 err = fuse_copy_fill(cs);
1016 if (err)
1017 return err;
1018 }
1019 }
1020 if (page) {
1021 void *mapaddr = kmap_atomic(page);
1022 void *buf = mapaddr + offset;
1023 offset += fuse_copy_do(cs, &buf, &count);
1024 kunmap_atomic(mapaddr);
1025 } else
1026 offset += fuse_copy_do(cs, NULL, &count);
1027 }
1028 if (page && !cs->write)
1029 flush_dcache_page(page);
1030 return 0;
1031 }
1032
1033 /* Copy pages in the request to/from userspace buffer */
1034 static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
1035 int zeroing)
1036 {
1037 unsigned i;
1038 struct fuse_req *req = cs->req;
1039
1040 for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
1041 int err;
1042 unsigned offset = req->page_descs[i].offset;
1043 unsigned count = min(nbytes, req->page_descs[i].length);
1044
1045 err = fuse_copy_page(cs, &req->pages[i], offset, count,
1046 zeroing);
1047 if (err)
1048 return err;
1049
1050 nbytes -= count;
1051 }
1052 return 0;
1053 }
1054
1055 /* Copy a single argument in the request to/from userspace buffer */
1056 static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
1057 {
1058 while (size) {
1059 if (!cs->len) {
1060 int err = fuse_copy_fill(cs);
1061 if (err)
1062 return err;
1063 }
1064 fuse_copy_do(cs, &val, &size);
1065 }
1066 return 0;
1067 }
1068
1069 /* Copy request arguments to/from userspace buffer */
1070 static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
1071 unsigned argpages, struct fuse_arg *args,
1072 int zeroing)
1073 {
1074 int err = 0;
1075 unsigned i;
1076
1077 for (i = 0; !err && i < numargs; i++) {
1078 struct fuse_arg *arg = &args[i];
1079 if (i == numargs - 1 && argpages)
1080 err = fuse_copy_pages(cs, arg->size, zeroing);
1081 else
1082 err = fuse_copy_one(cs, arg->value, arg->size);
1083 }
1084 return err;
1085 }
1086
1087 static int forget_pending(struct fuse_iqueue *fiq)
1088 {
1089 return fiq->forget_list_head.next != NULL;
1090 }
1091
1092 static int request_pending(struct fuse_iqueue *fiq)
1093 {
1094 return !list_empty(&fiq->pending) || !list_empty(&fiq->interrupts) ||
1095 forget_pending(fiq);
1096 }
1097
1098 /*
1099 * Transfer an interrupt request to userspace
1100 *
1101 * Unlike other requests this is assembled on demand, without a need
1102 * to allocate a separate fuse_req structure.
1103 *
1104 * Called with fiq->waitq.lock held, releases it
1105 */
1106 static int fuse_read_interrupt(struct fuse_iqueue *fiq,
1107 struct fuse_copy_state *cs,
1108 size_t nbytes, struct fuse_req *req)
1109 __releases(fiq->waitq.lock)
1110 {
1111 struct fuse_in_header ih;
1112 struct fuse_interrupt_in arg;
1113 unsigned reqsize = sizeof(ih) + sizeof(arg);
1114 int err;
1115
1116 list_del_init(&req->intr_entry);
1117 req->intr_unique = fuse_get_unique(fiq);
1118 memset(&ih, 0, sizeof(ih));
1119 memset(&arg, 0, sizeof(arg));
1120 ih.len = reqsize;
1121 ih.opcode = FUSE_INTERRUPT;
1122 ih.unique = req->intr_unique;
1123 arg.unique = req->in.h.unique;
1124
1125 spin_unlock(&fiq->waitq.lock);
1126 if (nbytes < reqsize)
1127 return -EINVAL;
1128
1129 err = fuse_copy_one(cs, &ih, sizeof(ih));
1130 if (!err)
1131 err = fuse_copy_one(cs, &arg, sizeof(arg));
1132 fuse_copy_finish(cs);
1133
1134 return err ? err : reqsize;
1135 }
1136
1137 static struct fuse_forget_link *dequeue_forget(struct fuse_iqueue *fiq,
1138 unsigned max,
1139 unsigned *countp)
1140 {
1141 struct fuse_forget_link *head = fiq->forget_list_head.next;
1142 struct fuse_forget_link **newhead = &head;
1143 unsigned count;
1144
1145 for (count = 0; *newhead != NULL && count < max; count++)
1146 newhead = &(*newhead)->next;
1147
1148 fiq->forget_list_head.next = *newhead;
1149 *newhead = NULL;
1150 if (fiq->forget_list_head.next == NULL)
1151 fiq->forget_list_tail = &fiq->forget_list_head;
1152
1153 if (countp != NULL)
1154 *countp = count;
1155
1156 return head;
1157 }
1158
1159 static int fuse_read_single_forget(struct fuse_iqueue *fiq,
1160 struct fuse_copy_state *cs,
1161 size_t nbytes)
1162 __releases(fiq->waitq.lock)
1163 {
1164 int err;
1165 struct fuse_forget_link *forget = dequeue_forget(fiq, 1, NULL);
1166 struct fuse_forget_in arg = {
1167 .nlookup = forget->forget_one.nlookup,
1168 };
1169 struct fuse_in_header ih = {
1170 .opcode = FUSE_FORGET,
1171 .nodeid = forget->forget_one.nodeid,
1172 .unique = fuse_get_unique(fiq),
1173 .len = sizeof(ih) + sizeof(arg),
1174 };
1175
1176 spin_unlock(&fiq->waitq.lock);
1177 kfree(forget);
1178 if (nbytes < ih.len)
1179 return -EINVAL;
1180
1181 err = fuse_copy_one(cs, &ih, sizeof(ih));
1182 if (!err)
1183 err = fuse_copy_one(cs, &arg, sizeof(arg));
1184 fuse_copy_finish(cs);
1185
1186 if (err)
1187 return err;
1188
1189 return ih.len;
1190 }
1191
1192 static int fuse_read_batch_forget(struct fuse_iqueue *fiq,
1193 struct fuse_copy_state *cs, size_t nbytes)
1194 __releases(fiq->waitq.lock)
1195 {
1196 int err;
1197 unsigned max_forgets;
1198 unsigned count;
1199 struct fuse_forget_link *head;
1200 struct fuse_batch_forget_in arg = { .count = 0 };
1201 struct fuse_in_header ih = {
1202 .opcode = FUSE_BATCH_FORGET,
1203 .unique = fuse_get_unique(fiq),
1204 .len = sizeof(ih) + sizeof(arg),
1205 };
1206
1207 if (nbytes < ih.len) {
1208 spin_unlock(&fiq->waitq.lock);
1209 return -EINVAL;
1210 }
1211
1212 max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
1213 head = dequeue_forget(fiq, max_forgets, &count);
1214 spin_unlock(&fiq->waitq.lock);
1215
1216 arg.count = count;
1217 ih.len += count * sizeof(struct fuse_forget_one);
1218 err = fuse_copy_one(cs, &ih, sizeof(ih));
1219 if (!err)
1220 err = fuse_copy_one(cs, &arg, sizeof(arg));
1221
1222 while (head) {
1223 struct fuse_forget_link *forget = head;
1224
1225 if (!err) {
1226 err = fuse_copy_one(cs, &forget->forget_one,
1227 sizeof(forget->forget_one));
1228 }
1229 head = forget->next;
1230 kfree(forget);
1231 }
1232
1233 fuse_copy_finish(cs);
1234
1235 if (err)
1236 return err;
1237
1238 return ih.len;
1239 }
1240
1241 static int fuse_read_forget(struct fuse_conn *fc, struct fuse_iqueue *fiq,
1242 struct fuse_copy_state *cs,
1243 size_t nbytes)
1244 __releases(fiq->waitq.lock)
1245 {
1246 if (fc->minor < 16 || fiq->forget_list_head.next->next == NULL)
1247 return fuse_read_single_forget(fiq, cs, nbytes);
1248 else
1249 return fuse_read_batch_forget(fiq, cs, nbytes);
1250 }
1251
1252 /*
1253 * Read a single request into the userspace filesystem's buffer. This
1254 * function waits until a request is available, then removes it from
1255 * the pending list and copies request data to userspace buffer. If
1256 * no reply is needed (FORGET) or request has been aborted or there
1257 * was an error during the copying then it's finished by calling
1258 * request_end(). Otherwise add it to the processing list, and set
1259 * the 'sent' flag.
1260 */
1261 static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
1262 struct fuse_copy_state *cs, size_t nbytes)
1263 {
1264 ssize_t err;
1265 struct fuse_conn *fc = fud->fc;
1266 struct fuse_iqueue *fiq = &fc->iq;
1267 struct fuse_pqueue *fpq = &fud->pq;
1268 struct fuse_req *req;
1269 struct fuse_in *in;
1270 unsigned reqsize;
1271
1272 restart:
1273 spin_lock(&fiq->waitq.lock);
1274 err = -EAGAIN;
1275 if ((file->f_flags & O_NONBLOCK) && fiq->connected &&
1276 !request_pending(fiq))
1277 goto err_unlock;
1278
1279 err = wait_event_interruptible_exclusive_locked(fiq->waitq,
1280 !fiq->connected || request_pending(fiq));
1281 if (err)
1282 goto err_unlock;
1283
1284 err = -ENODEV;
1285 if (!fiq->connected)
1286 goto err_unlock;
1287
1288 if (!list_empty(&fiq->interrupts)) {
1289 req = list_entry(fiq->interrupts.next, struct fuse_req,
1290 intr_entry);
1291 return fuse_read_interrupt(fiq, cs, nbytes, req);
1292 }
1293
1294 if (forget_pending(fiq)) {
1295 if (list_empty(&fiq->pending) || fiq->forget_batch-- > 0)
1296 return fuse_read_forget(fc, fiq, cs, nbytes);
1297
1298 if (fiq->forget_batch <= -8)
1299 fiq->forget_batch = 16;
1300 }
1301
1302 req = list_entry(fiq->pending.next, struct fuse_req, list);
1303 clear_bit(FR_PENDING, &req->flags);
1304 list_del_init(&req->list);
1305 spin_unlock(&fiq->waitq.lock);
1306
1307 in = &req->in;
1308 reqsize = in->h.len;
1309 /* If request is too large, reply with an error and restart the read */
1310 if (nbytes < reqsize) {
1311 req->out.h.error = -EIO;
1312 /* SETXATTR is special, since it may contain too large data */
1313 if (in->h.opcode == FUSE_SETXATTR)
1314 req->out.h.error = -E2BIG;
1315 request_end(fc, req);
1316 goto restart;
1317 }
1318 spin_lock(&fpq->lock);
1319 list_add(&req->list, &fpq->io);
1320 spin_unlock(&fpq->lock);
1321 cs->req = req;
1322 err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1323 if (!err)
1324 err = fuse_copy_args(cs, in->numargs, in->argpages,
1325 (struct fuse_arg *) in->args, 0);
1326 fuse_copy_finish(cs);
1327 spin_lock(&fpq->lock);
1328 clear_bit(FR_LOCKED, &req->flags);
1329 if (!fpq->connected) {
1330 err = -ENODEV;
1331 goto out_end;
1332 }
1333 if (err) {
1334 req->out.h.error = -EIO;
1335 goto out_end;
1336 }
1337 if (!test_bit(FR_ISREPLY, &req->flags)) {
1338 err = reqsize;
1339 goto out_end;
1340 }
1341 list_move_tail(&req->list, &fpq->processing);
1342 __fuse_get_request(req);
1343 set_bit(FR_SENT, &req->flags);
1344 spin_unlock(&fpq->lock);
1345 /* matches barrier in request_wait_answer() */
1346 smp_mb__after_atomic();
1347 if (test_bit(FR_INTERRUPTED, &req->flags))
1348 queue_interrupt(fiq, req);
1349 fuse_put_request(fc, req);
1350
1351 return reqsize;
1352
1353 out_end:
1354 if (!test_bit(FR_PRIVATE, &req->flags))
1355 list_del_init(&req->list);
1356 spin_unlock(&fpq->lock);
1357 request_end(fc, req);
1358 return err;
1359
1360 err_unlock:
1361 spin_unlock(&fiq->waitq.lock);
1362 return err;
1363 }
1364
1365 static int fuse_dev_open(struct inode *inode, struct file *file)
1366 {
1367 /*
1368 * The fuse device's file's private_data is used to hold
1369 * the fuse_conn(ection) when it is mounted, and is used to
1370 * keep track of whether the file has been mounted already.
1371 */
1372 file->private_data = NULL;
1373 return 0;
1374 }
1375
1376 static ssize_t fuse_dev_read(struct kiocb *iocb, struct iov_iter *to)
1377 {
1378 struct fuse_copy_state cs;
1379 struct file *file = iocb->ki_filp;
1380 struct fuse_dev *fud = fuse_get_dev(file);
1381
1382 if (!fud)
1383 return -EPERM;
1384
1385 if (!iter_is_iovec(to))
1386 return -EINVAL;
1387
1388 fuse_copy_init(&cs, 1, to);
1389
1390 return fuse_dev_do_read(fud, file, &cs, iov_iter_count(to));
1391 }
1392
1393 static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1394 struct pipe_inode_info *pipe,
1395 size_t len, unsigned int flags)
1396 {
1397 int ret;
1398 int page_nr = 0;
1399 int do_wakeup = 0;
1400 struct pipe_buffer *bufs;
1401 struct fuse_copy_state cs;
1402 struct fuse_dev *fud = fuse_get_dev(in);
1403
1404 if (!fud)
1405 return -EPERM;
1406
1407 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1408 if (!bufs)
1409 return -ENOMEM;
1410
1411 fuse_copy_init(&cs, 1, NULL);
1412 cs.pipebufs = bufs;
1413 cs.pipe = pipe;
1414 ret = fuse_dev_do_read(fud, in, &cs, len);
1415 if (ret < 0)
1416 goto out;
1417
1418 ret = 0;
1419 pipe_lock(pipe);
1420
1421 if (!pipe->readers) {
1422 send_sig(SIGPIPE, current, 0);
1423 if (!ret)
1424 ret = -EPIPE;
1425 goto out_unlock;
1426 }
1427
1428 if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
1429 ret = -EIO;
1430 goto out_unlock;
1431 }
1432
1433 while (page_nr < cs.nr_segs) {
1434 int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
1435 struct pipe_buffer *buf = pipe->bufs + newbuf;
1436
1437 buf->page = bufs[page_nr].page;
1438 buf->offset = bufs[page_nr].offset;
1439 buf->len = bufs[page_nr].len;
1440 /*
1441 * Need to be careful about this. Having buf->ops in module
1442 * code can Oops if the buffer persists after module unload.
1443 */
1444 buf->ops = &nosteal_pipe_buf_ops;
1445
1446 pipe->nrbufs++;
1447 page_nr++;
1448 ret += buf->len;
1449
1450 if (pipe->files)
1451 do_wakeup = 1;
1452 }
1453
1454 out_unlock:
1455 pipe_unlock(pipe);
1456
1457 if (do_wakeup) {
1458 smp_mb();
1459 if (waitqueue_active(&pipe->wait))
1460 wake_up_interruptible(&pipe->wait);
1461 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
1462 }
1463
1464 out:
1465 for (; page_nr < cs.nr_segs; page_nr++)
1466 page_cache_release(bufs[page_nr].page);
1467
1468 kfree(bufs);
1469 return ret;
1470 }
1471
1472 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
1473 struct fuse_copy_state *cs)
1474 {
1475 struct fuse_notify_poll_wakeup_out outarg;
1476 int err = -EINVAL;
1477
1478 if (size != sizeof(outarg))
1479 goto err;
1480
1481 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1482 if (err)
1483 goto err;
1484
1485 fuse_copy_finish(cs);
1486 return fuse_notify_poll_wakeup(fc, &outarg);
1487
1488 err:
1489 fuse_copy_finish(cs);
1490 return err;
1491 }
1492
1493 static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
1494 struct fuse_copy_state *cs)
1495 {
1496 struct fuse_notify_inval_inode_out outarg;
1497 int err = -EINVAL;
1498
1499 if (size != sizeof(outarg))
1500 goto err;
1501
1502 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1503 if (err)
1504 goto err;
1505 fuse_copy_finish(cs);
1506
1507 down_read(&fc->killsb);
1508 err = -ENOENT;
1509 if (fc->sb) {
1510 err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
1511 outarg.off, outarg.len);
1512 }
1513 up_read(&fc->killsb);
1514 return err;
1515
1516 err:
1517 fuse_copy_finish(cs);
1518 return err;
1519 }
1520
1521 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
1522 struct fuse_copy_state *cs)
1523 {
1524 struct fuse_notify_inval_entry_out outarg;
1525 int err = -ENOMEM;
1526 char *buf;
1527 struct qstr name;
1528
1529 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1530 if (!buf)
1531 goto err;
1532
1533 err = -EINVAL;
1534 if (size < sizeof(outarg))
1535 goto err;
1536
1537 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1538 if (err)
1539 goto err;
1540
1541 err = -ENAMETOOLONG;
1542 if (outarg.namelen > FUSE_NAME_MAX)
1543 goto err;
1544
1545 err = -EINVAL;
1546 if (size != sizeof(outarg) + outarg.namelen + 1)
1547 goto err;
1548
1549 name.name = buf;
1550 name.len = outarg.namelen;
1551 err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1552 if (err)
1553 goto err;
1554 fuse_copy_finish(cs);
1555 buf[outarg.namelen] = 0;
1556 name.hash = full_name_hash(name.name, name.len);
1557
1558 down_read(&fc->killsb);
1559 err = -ENOENT;
1560 if (fc->sb)
1561 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
1562 up_read(&fc->killsb);
1563 kfree(buf);
1564 return err;
1565
1566 err:
1567 kfree(buf);
1568 fuse_copy_finish(cs);
1569 return err;
1570 }
1571
1572 static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
1573 struct fuse_copy_state *cs)
1574 {
1575 struct fuse_notify_delete_out outarg;
1576 int err = -ENOMEM;
1577 char *buf;
1578 struct qstr name;
1579
1580 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1581 if (!buf)
1582 goto err;
1583
1584 err = -EINVAL;
1585 if (size < sizeof(outarg))
1586 goto err;
1587
1588 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1589 if (err)
1590 goto err;
1591
1592 err = -ENAMETOOLONG;
1593 if (outarg.namelen > FUSE_NAME_MAX)
1594 goto err;
1595
1596 err = -EINVAL;
1597 if (size != sizeof(outarg) + outarg.namelen + 1)
1598 goto err;
1599
1600 name.name = buf;
1601 name.len = outarg.namelen;
1602 err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1603 if (err)
1604 goto err;
1605 fuse_copy_finish(cs);
1606 buf[outarg.namelen] = 0;
1607 name.hash = full_name_hash(name.name, name.len);
1608
1609 down_read(&fc->killsb);
1610 err = -ENOENT;
1611 if (fc->sb)
1612 err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
1613 outarg.child, &name);
1614 up_read(&fc->killsb);
1615 kfree(buf);
1616 return err;
1617
1618 err:
1619 kfree(buf);
1620 fuse_copy_finish(cs);
1621 return err;
1622 }
1623
1624 static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
1625 struct fuse_copy_state *cs)
1626 {
1627 struct fuse_notify_store_out outarg;
1628 struct inode *inode;
1629 struct address_space *mapping;
1630 u64 nodeid;
1631 int err;
1632 pgoff_t index;
1633 unsigned int offset;
1634 unsigned int num;
1635 loff_t file_size;
1636 loff_t end;
1637
1638 err = -EINVAL;
1639 if (size < sizeof(outarg))
1640 goto out_finish;
1641
1642 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1643 if (err)
1644 goto out_finish;
1645
1646 err = -EINVAL;
1647 if (size - sizeof(outarg) != outarg.size)
1648 goto out_finish;
1649
1650 nodeid = outarg.nodeid;
1651
1652 down_read(&fc->killsb);
1653
1654 err = -ENOENT;
1655 if (!fc->sb)
1656 goto out_up_killsb;
1657
1658 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1659 if (!inode)
1660 goto out_up_killsb;
1661
1662 mapping = inode->i_mapping;
1663 index = outarg.offset >> PAGE_CACHE_SHIFT;
1664 offset = outarg.offset & ~PAGE_CACHE_MASK;
1665 file_size = i_size_read(inode);
1666 end = outarg.offset + outarg.size;
1667 if (end > file_size) {
1668 file_size = end;
1669 fuse_write_update_size(inode, file_size);
1670 }
1671
1672 num = outarg.size;
1673 while (num) {
1674 struct page *page;
1675 unsigned int this_num;
1676
1677 err = -ENOMEM;
1678 page = find_or_create_page(mapping, index,
1679 mapping_gfp_mask(mapping));
1680 if (!page)
1681 goto out_iput;
1682
1683 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1684 err = fuse_copy_page(cs, &page, offset, this_num, 0);
1685 if (!err && offset == 0 &&
1686 (this_num == PAGE_CACHE_SIZE || file_size == end))
1687 SetPageUptodate(page);
1688 unlock_page(page);
1689 page_cache_release(page);
1690
1691 if (err)
1692 goto out_iput;
1693
1694 num -= this_num;
1695 offset = 0;
1696 index++;
1697 }
1698
1699 err = 0;
1700
1701 out_iput:
1702 iput(inode);
1703 out_up_killsb:
1704 up_read(&fc->killsb);
1705 out_finish:
1706 fuse_copy_finish(cs);
1707 return err;
1708 }
1709
1710 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
1711 {
1712 release_pages(req->pages, req->num_pages, false);
1713 }
1714
1715 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
1716 struct fuse_notify_retrieve_out *outarg)
1717 {
1718 int err;
1719 struct address_space *mapping = inode->i_mapping;
1720 struct fuse_req *req;
1721 pgoff_t index;
1722 loff_t file_size;
1723 unsigned int num;
1724 unsigned int offset;
1725 size_t total_len = 0;
1726 int num_pages;
1727
1728 offset = outarg->offset & ~PAGE_CACHE_MASK;
1729 file_size = i_size_read(inode);
1730
1731 num = min(outarg->size, fc->max_write);
1732 if (outarg->offset > file_size)
1733 num = 0;
1734 else if (outarg->offset + num > file_size)
1735 num = file_size - outarg->offset;
1736
1737 num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1738 num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);
1739
1740 req = fuse_get_req(fc, num_pages);
1741 if (IS_ERR(req))
1742 return PTR_ERR(req);
1743
1744 req->in.h.opcode = FUSE_NOTIFY_REPLY;
1745 req->in.h.nodeid = outarg->nodeid;
1746 req->in.numargs = 2;
1747 req->in.argpages = 1;
1748 req->end = fuse_retrieve_end;
1749
1750 index = outarg->offset >> PAGE_CACHE_SHIFT;
1751
1752 while (num && req->num_pages < num_pages) {
1753 struct page *page;
1754 unsigned int this_num;
1755
1756 page = find_get_page(mapping, index);
1757 if (!page)
1758 break;
1759
1760 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1761 req->pages[req->num_pages] = page;
1762 req->page_descs[req->num_pages].offset = offset;
1763 req->page_descs[req->num_pages].length = this_num;
1764 req->num_pages++;
1765
1766 offset = 0;
1767 num -= this_num;
1768 total_len += this_num;
1769 index++;
1770 }
1771 req->misc.retrieve_in.offset = outarg->offset;
1772 req->misc.retrieve_in.size = total_len;
1773 req->in.args[0].size = sizeof(req->misc.retrieve_in);
1774 req->in.args[0].value = &req->misc.retrieve_in;
1775 req->in.args[1].size = total_len;
1776
1777 err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
1778 if (err) {
1779 fuse_retrieve_end(fc, req);
1780 fuse_put_request(fc, req);
1781 }
1782
1783 return err;
1784 }
1785
1786 static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
1787 struct fuse_copy_state *cs)
1788 {
1789 struct fuse_notify_retrieve_out outarg;
1790 struct inode *inode;
1791 int err;
1792
1793 err = -EINVAL;
1794 if (size != sizeof(outarg))
1795 goto copy_finish;
1796
1797 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1798 if (err)
1799 goto copy_finish;
1800
1801 fuse_copy_finish(cs);
1802
1803 down_read(&fc->killsb);
1804 err = -ENOENT;
1805 if (fc->sb) {
1806 u64 nodeid = outarg.nodeid;
1807
1808 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1809 if (inode) {
1810 err = fuse_retrieve(fc, inode, &outarg);
1811 iput(inode);
1812 }
1813 }
1814 up_read(&fc->killsb);
1815
1816 return err;
1817
1818 copy_finish:
1819 fuse_copy_finish(cs);
1820 return err;
1821 }
1822
1823 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
1824 unsigned int size, struct fuse_copy_state *cs)
1825 {
1826 /* Don't try to move pages (yet) */
1827 cs->move_pages = 0;
1828
1829 switch (code) {
1830 case FUSE_NOTIFY_POLL:
1831 return fuse_notify_poll(fc, size, cs);
1832
1833 case FUSE_NOTIFY_INVAL_INODE:
1834 return fuse_notify_inval_inode(fc, size, cs);
1835
1836 case FUSE_NOTIFY_INVAL_ENTRY:
1837 return fuse_notify_inval_entry(fc, size, cs);
1838
1839 case FUSE_NOTIFY_STORE:
1840 return fuse_notify_store(fc, size, cs);
1841
1842 case FUSE_NOTIFY_RETRIEVE:
1843 return fuse_notify_retrieve(fc, size, cs);
1844
1845 case FUSE_NOTIFY_DELETE:
1846 return fuse_notify_delete(fc, size, cs);
1847
1848 default:
1849 fuse_copy_finish(cs);
1850 return -EINVAL;
1851 }
1852 }
1853
1854 /* Look up request on processing list by unique ID */
1855 static struct fuse_req *request_find(struct fuse_pqueue *fpq, u64 unique)
1856 {
1857 struct fuse_req *req;
1858
1859 list_for_each_entry(req, &fpq->processing, list) {
1860 if (req->in.h.unique == unique || req->intr_unique == unique)
1861 return req;
1862 }
1863 return NULL;
1864 }
1865
1866 static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
1867 unsigned nbytes)
1868 {
1869 unsigned reqsize = sizeof(struct fuse_out_header);
1870
1871 if (out->h.error)
1872 return nbytes != reqsize ? -EINVAL : 0;
1873
1874 reqsize += len_args(out->numargs, out->args);
1875
1876 if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
1877 return -EINVAL;
1878 else if (reqsize > nbytes) {
1879 struct fuse_arg *lastarg = &out->args[out->numargs-1];
1880 unsigned diffsize = reqsize - nbytes;
1881 if (diffsize > lastarg->size)
1882 return -EINVAL;
1883 lastarg->size -= diffsize;
1884 }
1885 return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
1886 out->page_zeroing);
1887 }
1888
1889 /*
1890 * Write a single reply to a request. First the header is copied from
1891 * the write buffer. The request is then searched on the processing
1892 * list by the unique ID found in the header. If found, then remove
1893 * it from the list and copy the rest of the buffer to the request.
1894 * The request is finished by calling request_end()
1895 */
1896 static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
1897 struct fuse_copy_state *cs, size_t nbytes)
1898 {
1899 int err;
1900 struct fuse_conn *fc = fud->fc;
1901 struct fuse_pqueue *fpq = &fud->pq;
1902 struct fuse_req *req;
1903 struct fuse_out_header oh;
1904
1905 if (nbytes < sizeof(struct fuse_out_header))
1906 return -EINVAL;
1907
1908 err = fuse_copy_one(cs, &oh, sizeof(oh));
1909 if (err)
1910 goto err_finish;
1911
1912 err = -EINVAL;
1913 if (oh.len != nbytes)
1914 goto err_finish;
1915
1916 /*
1917 * Zero oh.unique indicates unsolicited notification message
1918 * and error contains notification code.
1919 */
1920 if (!oh.unique) {
1921 err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1922 return err ? err : nbytes;
1923 }
1924
1925 err = -EINVAL;
1926 if (oh.error <= -1000 || oh.error > 0)
1927 goto err_finish;
1928
1929 spin_lock(&fpq->lock);
1930 err = -ENOENT;
1931 if (!fpq->connected)
1932 goto err_unlock_pq;
1933
1934 req = request_find(fpq, oh.unique);
1935 if (!req)
1936 goto err_unlock_pq;
1937
1938 /* Is it an interrupt reply? */
1939 if (req->intr_unique == oh.unique) {
1940 __fuse_get_request(req);
1941 spin_unlock(&fpq->lock);
1942
1943 err = -EINVAL;
1944 if (nbytes != sizeof(struct fuse_out_header)) {
1945 fuse_put_request(fc, req);
1946 goto err_finish;
1947 }
1948
1949 if (oh.error == -ENOSYS)
1950 fc->no_interrupt = 1;
1951 else if (oh.error == -EAGAIN)
1952 queue_interrupt(&fc->iq, req);
1953 fuse_put_request(fc, req);
1954
1955 fuse_copy_finish(cs);
1956 return nbytes;
1957 }
1958
1959 clear_bit(FR_SENT, &req->flags);
1960 list_move(&req->list, &fpq->io);
1961 req->out.h = oh;
1962 set_bit(FR_LOCKED, &req->flags);
1963 spin_unlock(&fpq->lock);
1964 cs->req = req;
1965 if (!req->out.page_replace)
1966 cs->move_pages = 0;
1967
1968 err = copy_out_args(cs, &req->out, nbytes);
1969 fuse_copy_finish(cs);
1970
1971 spin_lock(&fpq->lock);
1972 clear_bit(FR_LOCKED, &req->flags);
1973 if (!fpq->connected)
1974 err = -ENOENT;
1975 else if (err)
1976 req->out.h.error = -EIO;
1977 if (!test_bit(FR_PRIVATE, &req->flags))
1978 list_del_init(&req->list);
1979 spin_unlock(&fpq->lock);
1980
1981 request_end(fc, req);
1982
1983 return err ? err : nbytes;
1984
1985 err_unlock_pq:
1986 spin_unlock(&fpq->lock);
1987 err_finish:
1988 fuse_copy_finish(cs);
1989 return err;
1990 }
1991
1992 static ssize_t fuse_dev_write(struct kiocb *iocb, struct iov_iter *from)
1993 {
1994 struct fuse_copy_state cs;
1995 struct fuse_dev *fud = fuse_get_dev(iocb->ki_filp);
1996
1997 if (!fud)
1998 return -EPERM;
1999
2000 if (!iter_is_iovec(from))
2001 return -EINVAL;
2002
2003 fuse_copy_init(&cs, 0, from);
2004
2005 return fuse_dev_do_write(fud, &cs, iov_iter_count(from));
2006 }
2007
2008 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
2009 struct file *out, loff_t *ppos,
2010 size_t len, unsigned int flags)
2011 {
2012 unsigned nbuf;
2013 unsigned idx;
2014 struct pipe_buffer *bufs;
2015 struct fuse_copy_state cs;
2016 struct fuse_dev *fud;
2017 size_t rem;
2018 ssize_t ret;
2019
2020 fud = fuse_get_dev(out);
2021 if (!fud)
2022 return -EPERM;
2023
2024 pipe_lock(pipe);
2025
2026 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
2027 if (!bufs) {
2028 pipe_unlock(pipe);
2029 return -ENOMEM;
2030 }
2031
2032 nbuf = 0;
2033 rem = 0;
2034 for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
2035 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
2036
2037 ret = -EINVAL;
2038 if (rem < len)
2039 goto out_free;
2040
2041 rem = len;
2042 while (rem) {
2043 struct pipe_buffer *ibuf;
2044 struct pipe_buffer *obuf;
2045
2046 BUG_ON(nbuf >= pipe->buffers);
2047 BUG_ON(!pipe->nrbufs);
2048 ibuf = &pipe->bufs[pipe->curbuf];
2049 obuf = &bufs[nbuf];
2050
2051 if (rem >= ibuf->len) {
2052 *obuf = *ibuf;
2053 ibuf->ops = NULL;
2054 pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
2055 pipe->nrbufs--;
2056 } else {
2057 if (!pipe_buf_get(pipe, ibuf))
2058 goto out_free;
2059
2060 *obuf = *ibuf;
2061 obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
2062 obuf->len = rem;
2063 ibuf->offset += obuf->len;
2064 ibuf->len -= obuf->len;
2065 }
2066 nbuf++;
2067 rem -= obuf->len;
2068 }
2069 pipe_unlock(pipe);
2070
2071 fuse_copy_init(&cs, 0, NULL);
2072 cs.pipebufs = bufs;
2073 cs.nr_segs = nbuf;
2074 cs.pipe = pipe;
2075
2076 if (flags & SPLICE_F_MOVE)
2077 cs.move_pages = 1;
2078
2079 ret = fuse_dev_do_write(fud, &cs, len);
2080
2081 pipe_lock(pipe);
2082 out_free:
2083 for (idx = 0; idx < nbuf; idx++) {
2084 struct pipe_buffer *buf = &bufs[idx];
2085 buf->ops->release(pipe, buf);
2086 }
2087 pipe_unlock(pipe);
2088
2089 kfree(bufs);
2090 return ret;
2091 }
2092
2093 static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
2094 {
2095 unsigned mask = POLLOUT | POLLWRNORM;
2096 struct fuse_iqueue *fiq;
2097 struct fuse_dev *fud = fuse_get_dev(file);
2098
2099 if (!fud)
2100 return POLLERR;
2101
2102 fiq = &fud->fc->iq;
2103 poll_wait(file, &fiq->waitq, wait);
2104
2105 spin_lock(&fiq->waitq.lock);
2106 if (!fiq->connected)
2107 mask = POLLERR;
2108 else if (request_pending(fiq))
2109 mask |= POLLIN | POLLRDNORM;
2110 spin_unlock(&fiq->waitq.lock);
2111
2112 return mask;
2113 }
2114
2115 /*
2116 * Abort all requests on the given list (pending or processing)
2117 *
2118 * This function releases and reacquires fc->lock
2119 */
2120 static void end_requests(struct fuse_conn *fc, struct list_head *head)
2121 {
2122 while (!list_empty(head)) {
2123 struct fuse_req *req;
2124 req = list_entry(head->next, struct fuse_req, list);
2125 req->out.h.error = -ECONNABORTED;
2126 clear_bit(FR_SENT, &req->flags);
2127 list_del_init(&req->list);
2128 request_end(fc, req);
2129 }
2130 }
2131
2132 static void end_polls(struct fuse_conn *fc)
2133 {
2134 struct rb_node *p;
2135
2136 p = rb_first(&fc->polled_files);
2137
2138 while (p) {
2139 struct fuse_file *ff;
2140 ff = rb_entry(p, struct fuse_file, polled_node);
2141 wake_up_interruptible_all(&ff->poll_wait);
2142
2143 p = rb_next(p);
2144 }
2145 }
2146
2147 /*
2148 * Abort all requests.
2149 *
2150 * Emergency exit in case of a malicious or accidental deadlock, or just a hung
2151 * filesystem.
2152 *
2153 * The same effect is usually achievable through killing the filesystem daemon
2154 * and all users of the filesystem. The exception is the combination of an
2155 * asynchronous request and the tricky deadlock (see
2156 * Documentation/filesystems/fuse.txt).
2157 *
2158 * Aborting requests under I/O goes as follows: 1: Separate out unlocked
2159 * requests, they should be finished off immediately. Locked requests will be
2160 * finished after unlock; see unlock_request(). 2: Finish off the unlocked
2161 * requests. It is possible that some request will finish before we can. This
2162 * is OK, the request will in that case be removed from the list before we touch
2163 * it.
2164 */
2165 void fuse_abort_conn(struct fuse_conn *fc)
2166 {
2167 struct fuse_iqueue *fiq = &fc->iq;
2168
2169 spin_lock(&fc->lock);
2170 if (fc->connected) {
2171 struct fuse_dev *fud;
2172 struct fuse_req *req, *next;
2173 LIST_HEAD(to_end1);
2174 LIST_HEAD(to_end2);
2175
2176 fc->connected = 0;
2177 fc->blocked = 0;
2178 fuse_set_initialized(fc);
2179 list_for_each_entry(fud, &fc->devices, entry) {
2180 struct fuse_pqueue *fpq = &fud->pq;
2181
2182 spin_lock(&fpq->lock);
2183 fpq->connected = 0;
2184 list_for_each_entry_safe(req, next, &fpq->io, list) {
2185 req->out.h.error = -ECONNABORTED;
2186 spin_lock(&req->waitq.lock);
2187 set_bit(FR_ABORTED, &req->flags);
2188 if (!test_bit(FR_LOCKED, &req->flags)) {
2189 set_bit(FR_PRIVATE, &req->flags);
2190 __fuse_get_request(req);
2191 list_move(&req->list, &to_end1);
2192 }
2193 spin_unlock(&req->waitq.lock);
2194 }
2195 list_splice_init(&fpq->processing, &to_end2);
2196 spin_unlock(&fpq->lock);
2197 }
2198 fc->max_background = UINT_MAX;
2199 flush_bg_queue(fc);
2200
2201 spin_lock(&fiq->waitq.lock);
2202 fiq->connected = 0;
2203 list_splice_init(&fiq->pending, &to_end2);
2204 list_for_each_entry(req, &to_end2, list)
2205 clear_bit(FR_PENDING, &req->flags);
2206 while (forget_pending(fiq))
2207 kfree(dequeue_forget(fiq, 1, NULL));
2208 wake_up_all_locked(&fiq->waitq);
2209 spin_unlock(&fiq->waitq.lock);
2210 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
2211 end_polls(fc);
2212 wake_up_all(&fc->blocked_waitq);
2213 spin_unlock(&fc->lock);
2214
2215 while (!list_empty(&to_end1)) {
2216 req = list_first_entry(&to_end1, struct fuse_req, list);
2217 list_del_init(&req->list);
2218 request_end(fc, req);
2219 }
2220 end_requests(fc, &to_end2);
2221 } else {
2222 spin_unlock(&fc->lock);
2223 }
2224 }
2225 EXPORT_SYMBOL_GPL(fuse_abort_conn);
2226
2227 void fuse_wait_aborted(struct fuse_conn *fc)
2228 {
2229 /* matches implicit memory barrier in fuse_drop_waiting() */
2230 smp_mb();
2231 wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
2232 }
2233
2234 int fuse_dev_release(struct inode *inode, struct file *file)
2235 {
2236 struct fuse_dev *fud = fuse_get_dev(file);
2237
2238 if (fud) {
2239 struct fuse_conn *fc = fud->fc;
2240 struct fuse_pqueue *fpq = &fud->pq;
2241 LIST_HEAD(to_end);
2242
2243 spin_lock(&fpq->lock);
2244 WARN_ON(!list_empty(&fpq->io));
2245 list_splice_init(&fpq->processing, &to_end);
2246 spin_unlock(&fpq->lock);
2247
2248 end_requests(fc, &to_end);
2249
2250 /* Are we the last open device? */
2251 if (atomic_dec_and_test(&fc->dev_count)) {
2252 WARN_ON(fc->iq.fasync != NULL);
2253 fuse_abort_conn(fc);
2254 }
2255 fuse_dev_free(fud);
2256 }
2257 return 0;
2258 }
2259 EXPORT_SYMBOL_GPL(fuse_dev_release);
2260
2261 static int fuse_dev_fasync(int fd, struct file *file, int on)
2262 {
2263 struct fuse_dev *fud = fuse_get_dev(file);
2264
2265 if (!fud)
2266 return -EPERM;
2267
2268 /* No locking - fasync_helper does its own locking */
2269 return fasync_helper(fd, file, on, &fud->fc->iq.fasync);
2270 }
2271
2272 static int fuse_device_clone(struct fuse_conn *fc, struct file *new)
2273 {
2274 struct fuse_dev *fud;
2275
2276 if (new->private_data)
2277 return -EINVAL;
2278
2279 fud = fuse_dev_alloc(fc);
2280 if (!fud)
2281 return -ENOMEM;
2282
2283 new->private_data = fud;
2284 atomic_inc(&fc->dev_count);
2285
2286 return 0;
2287 }
2288
2289 static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
2290 unsigned long arg)
2291 {
2292 int err = -ENOTTY;
2293
2294 if (cmd == FUSE_DEV_IOC_CLONE) {
2295 int oldfd;
2296
2297 err = -EFAULT;
2298 if (!get_user(oldfd, (__u32 __user *) arg)) {
2299 struct file *old = fget(oldfd);
2300
2301 err = -EINVAL;
2302 if (old) {
2303 struct fuse_dev *fud = NULL;
2304
2305 /*
2306 * Check against file->f_op because CUSE
2307 * uses the same ioctl handler.
2308 */
2309 if (old->f_op == file->f_op &&
2310 old->f_cred->user_ns == file->f_cred->user_ns)
2311 fud = fuse_get_dev(old);
2312
2313 if (fud) {
2314 mutex_lock(&fuse_mutex);
2315 err = fuse_device_clone(fud->fc, file);
2316 mutex_unlock(&fuse_mutex);
2317 }
2318 fput(old);
2319 }
2320 }
2321 }
2322 return err;
2323 }
2324
2325 const struct file_operations fuse_dev_operations = {
2326 .owner = THIS_MODULE,
2327 .open = fuse_dev_open,
2328 .llseek = no_llseek,
2329 .read_iter = fuse_dev_read,
2330 .splice_read = fuse_dev_splice_read,
2331 .write_iter = fuse_dev_write,
2332 .splice_write = fuse_dev_splice_write,
2333 .poll = fuse_dev_poll,
2334 .release = fuse_dev_release,
2335 .fasync = fuse_dev_fasync,
2336 .unlocked_ioctl = fuse_dev_ioctl,
2337 .compat_ioctl = fuse_dev_ioctl,
2338 };
2339 EXPORT_SYMBOL_GPL(fuse_dev_operations);
2340
2341 static struct miscdevice fuse_miscdevice = {
2342 .minor = FUSE_MINOR,
2343 .name = "fuse",
2344 .fops = &fuse_dev_operations,
2345 };
2346
2347 int __init fuse_dev_init(void)
2348 {
2349 int err = -ENOMEM;
2350 fuse_req_cachep = kmem_cache_create("fuse_request",
2351 sizeof(struct fuse_req),
2352 0, 0, NULL);
2353 if (!fuse_req_cachep)
2354 goto out;
2355
2356 err = misc_register(&fuse_miscdevice);
2357 if (err)
2358 goto out_cache_clean;
2359
2360 return 0;
2361
2362 out_cache_clean:
2363 kmem_cache_destroy(fuse_req_cachep);
2364 out:
2365 return err;
2366 }
2367
2368 void fuse_dev_cleanup(void)
2369 {
2370 misc_deregister(&fuse_miscdevice);
2371 kmem_cache_destroy(fuse_req_cachep);
2372 }
Linux with added FPC-III support