]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - fs/fuse/dev.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fuse: set FR_SENT while locked
[mirror_ubuntu-jammy-kernel.git] / fs / fuse / dev.c
1 /*
2 FUSE: Filesystem in Userspace
3 Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
4
5 This program can be distributed under the terms of the GNU GPL.
6 See the file COPYING.
7 */
8
9 #include "fuse_i.h"
10
11 #include <linux/init.h>
12 #include <linux/module.h>
13 #include <linux/poll.h>
14 #include <linux/sched/signal.h>
15 #include <linux/uio.h>
16 #include <linux/miscdevice.h>
17 #include <linux/pagemap.h>
18 #include <linux/file.h>
19 #include <linux/slab.h>
20 #include <linux/pipe_fs_i.h>
21 #include <linux/swap.h>
22 #include <linux/splice.h>
23 #include <linux/sched.h>
24
25 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
26 MODULE_ALIAS("devname:fuse");
27
28 static struct kmem_cache *fuse_req_cachep;
29
30 static struct fuse_dev *fuse_get_dev(struct file *file)
31 {
32 /*
33 * Lockless access is OK, because file->private data is set
34 * once during mount and is valid until the file is released.
35 */
36 return READ_ONCE(file->private_data);
37 }
38
39 static void fuse_request_init(struct fuse_req *req, struct page **pages,
40 struct fuse_page_desc *page_descs,
41 unsigned npages)
42 {
43 memset(req, 0, sizeof(*req));
44 memset(pages, 0, sizeof(*pages) * npages);
45 memset(page_descs, 0, sizeof(*page_descs) * npages);
46 INIT_LIST_HEAD(&req->list);
47 INIT_LIST_HEAD(&req->intr_entry);
48 init_waitqueue_head(&req->waitq);
49 refcount_set(&req->count, 1);
50 req->pages = pages;
51 req->page_descs = page_descs;
52 req->max_pages = npages;
53 __set_bit(FR_PENDING, &req->flags);
54 }
55
56 static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
57 {
58 struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
59 if (req) {
60 struct page **pages;
61 struct fuse_page_desc *page_descs;
62
63 if (npages <= FUSE_REQ_INLINE_PAGES) {
64 pages = req->inline_pages;
65 page_descs = req->inline_page_descs;
66 } else {
67 pages = kmalloc_array(npages, sizeof(struct page *),
68 flags);
69 page_descs =
70 kmalloc_array(npages,
71 sizeof(struct fuse_page_desc),
72 flags);
73 }
74
75 if (!pages || !page_descs) {
76 kfree(pages);
77 kfree(page_descs);
78 kmem_cache_free(fuse_req_cachep, req);
79 return NULL;
80 }
81
82 fuse_request_init(req, pages, page_descs, npages);
83 }
84 return req;
85 }
86
87 struct fuse_req *fuse_request_alloc(unsigned npages)
88 {
89 return __fuse_request_alloc(npages, GFP_KERNEL);
90 }
91 EXPORT_SYMBOL_GPL(fuse_request_alloc);
92
93 struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
94 {
95 return __fuse_request_alloc(npages, GFP_NOFS);
96 }
97
98 void fuse_request_free(struct fuse_req *req)
99 {
100 if (req->pages != req->inline_pages) {
101 kfree(req->pages);
102 kfree(req->page_descs);
103 }
104 kmem_cache_free(fuse_req_cachep, req);
105 }
106
107 void __fuse_get_request(struct fuse_req *req)
108 {
109 refcount_inc(&req->count);
110 }
111
112 /* Must be called with > 1 refcount */
113 static void __fuse_put_request(struct fuse_req *req)
114 {
115 refcount_dec(&req->count);
116 }
117
118 void fuse_set_initialized(struct fuse_conn *fc)
119 {
120 /* Make sure stores before this are seen on another CPU */
121 smp_wmb();
122 fc->initialized = 1;
123 }
124
125 static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
126 {
127 return !fc->initialized || (for_background && fc->blocked);
128 }
129
130 static void fuse_drop_waiting(struct fuse_conn *fc)
131 {
132 if (fc->connected) {
133 atomic_dec(&fc->num_waiting);
134 } else if (atomic_dec_and_test(&fc->num_waiting)) {
135 /* wake up aborters */
136 wake_up_all(&fc->blocked_waitq);
137 }
138 }
139
140 static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
141 bool for_background)
142 {
143 struct fuse_req *req;
144 int err;
145 atomic_inc(&fc->num_waiting);
146
147 if (fuse_block_alloc(fc, for_background)) {
148 err = -EINTR;
149 if (wait_event_killable_exclusive(fc->blocked_waitq,
150 !fuse_block_alloc(fc, for_background)))
151 goto out;
152 }
153 /* Matches smp_wmb() in fuse_set_initialized() */
154 smp_rmb();
155
156 err = -ENOTCONN;
157 if (!fc->connected)
158 goto out;
159
160 err = -ECONNREFUSED;
161 if (fc->conn_error)
162 goto out;
163
164 req = fuse_request_alloc(npages);
165 err = -ENOMEM;
166 if (!req) {
167 if (for_background)
168 wake_up(&fc->blocked_waitq);
169 goto out;
170 }
171
172 req->in.h.uid = from_kuid(fc->user_ns, current_fsuid());
173 req->in.h.gid = from_kgid(fc->user_ns, current_fsgid());
174 req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns);
175
176 __set_bit(FR_WAITING, &req->flags);
177 if (for_background)
178 __set_bit(FR_BACKGROUND, &req->flags);
179
180 if (unlikely(req->in.h.uid == ((uid_t)-1) ||
181 req->in.h.gid == ((gid_t)-1))) {
182 fuse_put_request(fc, req);
183 return ERR_PTR(-EOVERFLOW);
184 }
185 return req;
186
187 out:
188 fuse_drop_waiting(fc);
189 return ERR_PTR(err);
190 }
191
192 struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
193 {
194 return __fuse_get_req(fc, npages, false);
195 }
196 EXPORT_SYMBOL_GPL(fuse_get_req);
197
198 struct fuse_req *fuse_get_req_for_background(struct fuse_conn *fc,
199 unsigned npages)
200 {
201 return __fuse_get_req(fc, npages, true);
202 }
203 EXPORT_SYMBOL_GPL(fuse_get_req_for_background);
204
205 /*
206 * Return request in fuse_file->reserved_req. However that may
207 * currently be in use. If that is the case, wait for it to become
208 * available.
209 */
210 static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
211 struct file *file)
212 {
213 struct fuse_req *req = NULL;
214 struct fuse_file *ff = file->private_data;
215
216 do {
217 wait_event(fc->reserved_req_waitq, ff->reserved_req);
218 spin_lock(&fc->lock);
219 if (ff->reserved_req) {
220 req = ff->reserved_req;
221 ff->reserved_req = NULL;
222 req->stolen_file = get_file(file);
223 }
224 spin_unlock(&fc->lock);
225 } while (!req);
226
227 return req;
228 }
229
230 /*
231 * Put stolen request back into fuse_file->reserved_req
232 */
233 static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
234 {
235 struct file *file = req->stolen_file;
236 struct fuse_file *ff = file->private_data;
237
238 spin_lock(&fc->lock);
239 fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
240 BUG_ON(ff->reserved_req);
241 ff->reserved_req = req;
242 wake_up_all(&fc->reserved_req_waitq);
243 spin_unlock(&fc->lock);
244 fput(file);
245 }
246
247 /*
248 * Gets a requests for a file operation, always succeeds
249 *
250 * This is used for sending the FLUSH request, which must get to
251 * userspace, due to POSIX locks which may need to be unlocked.
252 *
253 * If allocation fails due to OOM, use the reserved request in
254 * fuse_file.
255 *
256 * This is very unlikely to deadlock accidentally, since the
257 * filesystem should not have it's own file open. If deadlock is
258 * intentional, it can still be broken by "aborting" the filesystem.
259 */
260 struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
261 struct file *file)
262 {
263 struct fuse_req *req;
264
265 atomic_inc(&fc->num_waiting);
266 wait_event(fc->blocked_waitq, fc->initialized);
267 /* Matches smp_wmb() in fuse_set_initialized() */
268 smp_rmb();
269 req = fuse_request_alloc(0);
270 if (!req)
271 req = get_reserved_req(fc, file);
272
273 req->in.h.uid = from_kuid_munged(fc->user_ns, current_fsuid());
274 req->in.h.gid = from_kgid_munged(fc->user_ns, current_fsgid());
275 req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns);
276
277 __set_bit(FR_WAITING, &req->flags);
278 __clear_bit(FR_BACKGROUND, &req->flags);
279 return req;
280 }
281
282 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
283 {
284 if (refcount_dec_and_test(&req->count)) {
285 if (test_bit(FR_BACKGROUND, &req->flags)) {
286 /*
287 * We get here in the unlikely case that a background
288 * request was allocated but not sent
289 */
290 spin_lock(&fc->lock);
291 if (!fc->blocked)
292 wake_up(&fc->blocked_waitq);
293 spin_unlock(&fc->lock);
294 }
295
296 if (test_bit(FR_WAITING, &req->flags)) {
297 __clear_bit(FR_WAITING, &req->flags);
298 fuse_drop_waiting(fc);
299 }
300
301 if (req->stolen_file)
302 put_reserved_req(fc, req);
303 else
304 fuse_request_free(req);
305 }
306 }
307 EXPORT_SYMBOL_GPL(fuse_put_request);
308
309 static unsigned len_args(unsigned numargs, struct fuse_arg *args)
310 {
311 unsigned nbytes = 0;
312 unsigned i;
313
314 for (i = 0; i < numargs; i++)
315 nbytes += args[i].size;
316
317 return nbytes;
318 }
319
320 static u64 fuse_get_unique(struct fuse_iqueue *fiq)
321 {
322 return ++fiq->reqctr;
323 }
324
325 static void queue_request(struct fuse_iqueue *fiq, struct fuse_req *req)
326 {
327 req->in.h.len = sizeof(struct fuse_in_header) +
328 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
329 list_add_tail(&req->list, &fiq->pending);
330 wake_up_locked(&fiq->waitq);
331 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
332 }
333
334 void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
335 u64 nodeid, u64 nlookup)
336 {
337 struct fuse_iqueue *fiq = &fc->iq;
338
339 forget->forget_one.nodeid = nodeid;
340 forget->forget_one.nlookup = nlookup;
341
342 spin_lock(&fiq->waitq.lock);
343 if (fiq->connected) {
344 fiq->forget_list_tail->next = forget;
345 fiq->forget_list_tail = forget;
346 wake_up_locked(&fiq->waitq);
347 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
348 } else {
349 kfree(forget);
350 }
351 spin_unlock(&fiq->waitq.lock);
352 }
353
354 static void flush_bg_queue(struct fuse_conn *fc)
355 {
356 while (fc->active_background < fc->max_background &&
357 !list_empty(&fc->bg_queue)) {
358 struct fuse_req *req;
359 struct fuse_iqueue *fiq = &fc->iq;
360
361 req = list_entry(fc->bg_queue.next, struct fuse_req, list);
362 list_del(&req->list);
363 fc->active_background++;
364 spin_lock(&fiq->waitq.lock);
365 req->in.h.unique = fuse_get_unique(fiq);
366 queue_request(fiq, req);
367 spin_unlock(&fiq->waitq.lock);
368 }
369 }
370
371 /*
372 * This function is called when a request is finished. Either a reply
373 * has arrived or it was aborted (and not yet sent) or some error
374 * occurred during communication with userspace, or the device file
375 * was closed. The requester thread is woken up (if still waiting),
376 * the 'end' callback is called if given, else the reference to the
377 * request is released
378 */
379 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
380 {
381 struct fuse_iqueue *fiq = &fc->iq;
382
383 if (test_and_set_bit(FR_FINISHED, &req->flags))
384 goto put_request;
385
386 spin_lock(&fiq->waitq.lock);
387 list_del_init(&req->intr_entry);
388 spin_unlock(&fiq->waitq.lock);
389 WARN_ON(test_bit(FR_PENDING, &req->flags));
390 WARN_ON(test_bit(FR_SENT, &req->flags));
391 if (test_bit(FR_BACKGROUND, &req->flags)) {
392 spin_lock(&fc->lock);
393 clear_bit(FR_BACKGROUND, &req->flags);
394 if (fc->num_background == fc->max_background)
395 fc->blocked = 0;
396
397 /* Wake up next waiter, if any */
398 if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
399 wake_up(&fc->blocked_waitq);
400
401 if (fc->num_background == fc->congestion_threshold && fc->sb) {
402 clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC);
403 clear_bdi_congested(fc->sb->s_bdi, BLK_RW_ASYNC);
404 }
405 fc->num_background--;
406 fc->active_background--;
407 flush_bg_queue(fc);
408 spin_unlock(&fc->lock);
409 }
410 wake_up(&req->waitq);
411 if (req->end)
412 req->end(fc, req);
413 put_request:
414 fuse_put_request(fc, req);
415 }
416
417 static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)
418 {
419 spin_lock(&fiq->waitq.lock);
420 if (test_bit(FR_FINISHED, &req->flags)) {
421 spin_unlock(&fiq->waitq.lock);
422 return;
423 }
424 if (list_empty(&req->intr_entry)) {
425 list_add_tail(&req->intr_entry, &fiq->interrupts);
426 wake_up_locked(&fiq->waitq);
427 }
428 spin_unlock(&fiq->waitq.lock);
429 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
430 }
431
432 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
433 {
434 struct fuse_iqueue *fiq = &fc->iq;
435 int err;
436
437 if (!fc->no_interrupt) {
438 /* Any signal may interrupt this */
439 err = wait_event_interruptible(req->waitq,
440 test_bit(FR_FINISHED, &req->flags));
441 if (!err)
442 return;
443
444 set_bit(FR_INTERRUPTED, &req->flags);
445 /* matches barrier in fuse_dev_do_read() */
446 smp_mb__after_atomic();
447 if (test_bit(FR_SENT, &req->flags))
448 queue_interrupt(fiq, req);
449 }
450
451 if (!test_bit(FR_FORCE, &req->flags)) {
452 /* Only fatal signals may interrupt this */
453 err = wait_event_killable(req->waitq,
454 test_bit(FR_FINISHED, &req->flags));
455 if (!err)
456 return;
457
458 spin_lock(&fiq->waitq.lock);
459 /* Request is not yet in userspace, bail out */
460 if (test_bit(FR_PENDING, &req->flags)) {
461 list_del(&req->list);
462 spin_unlock(&fiq->waitq.lock);
463 __fuse_put_request(req);
464 req->out.h.error = -EINTR;
465 return;
466 }
467 spin_unlock(&fiq->waitq.lock);
468 }
469
470 /*
471 * Either request is already in userspace, or it was forced.
472 * Wait it out.
473 */
474 wait_event(req->waitq, test_bit(FR_FINISHED, &req->flags));
475 }
476
477 static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
478 {
479 struct fuse_iqueue *fiq = &fc->iq;
480
481 BUG_ON(test_bit(FR_BACKGROUND, &req->flags));
482 spin_lock(&fiq->waitq.lock);
483 if (!fiq->connected) {
484 spin_unlock(&fiq->waitq.lock);
485 req->out.h.error = -ENOTCONN;
486 } else {
487 req->in.h.unique = fuse_get_unique(fiq);
488 queue_request(fiq, req);
489 /* acquire extra reference, since request is still needed
490 after request_end() */
491 __fuse_get_request(req);
492 spin_unlock(&fiq->waitq.lock);
493
494 request_wait_answer(fc, req);
495 /* Pairs with smp_wmb() in request_end() */
496 smp_rmb();
497 }
498 }
499
500 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
501 {
502 __set_bit(FR_ISREPLY, &req->flags);
503 if (!test_bit(FR_WAITING, &req->flags)) {
504 __set_bit(FR_WAITING, &req->flags);
505 atomic_inc(&fc->num_waiting);
506 }
507 __fuse_request_send(fc, req);
508 }
509 EXPORT_SYMBOL_GPL(fuse_request_send);
510
511 static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args)
512 {
513 if (fc->minor < 4 && args->in.h.opcode == FUSE_STATFS)
514 args->out.args[0].size = FUSE_COMPAT_STATFS_SIZE;
515
516 if (fc->minor < 9) {
517 switch (args->in.h.opcode) {
518 case FUSE_LOOKUP:
519 case FUSE_CREATE:
520 case FUSE_MKNOD:
521 case FUSE_MKDIR:
522 case FUSE_SYMLINK:
523 case FUSE_LINK:
524 args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE;
525 break;
526 case FUSE_GETATTR:
527 case FUSE_SETATTR:
528 args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE;
529 break;
530 }
531 }
532 if (fc->minor < 12) {
533 switch (args->in.h.opcode) {
534 case FUSE_CREATE:
535 args->in.args[0].size = sizeof(struct fuse_open_in);
536 break;
537 case FUSE_MKNOD:
538 args->in.args[0].size = FUSE_COMPAT_MKNOD_IN_SIZE;
539 break;
540 }
541 }
542 }
543
544 ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
545 {
546 struct fuse_req *req;
547 ssize_t ret;
548
549 req = fuse_get_req(fc, 0);
550 if (IS_ERR(req))
551 return PTR_ERR(req);
552
553 /* Needs to be done after fuse_get_req() so that fc->minor is valid */
554 fuse_adjust_compat(fc, args);
555
556 req->in.h.opcode = args->in.h.opcode;
557 req->in.h.nodeid = args->in.h.nodeid;
558 req->in.numargs = args->in.numargs;
559 memcpy(req->in.args, args->in.args,
560 args->in.numargs * sizeof(struct fuse_in_arg));
561 req->out.argvar = args->out.argvar;
562 req->out.numargs = args->out.numargs;
563 memcpy(req->out.args, args->out.args,
564 args->out.numargs * sizeof(struct fuse_arg));
565 fuse_request_send(fc, req);
566 ret = req->out.h.error;
567 if (!ret && args->out.argvar) {
568 BUG_ON(args->out.numargs != 1);
569 ret = req->out.args[0].size;
570 }
571 fuse_put_request(fc, req);
572
573 return ret;
574 }
575
576 /*
577 * Called under fc->lock
578 *
579 * fc->connected must have been checked previously
580 */
581 void fuse_request_send_background_locked(struct fuse_conn *fc,
582 struct fuse_req *req)
583 {
584 BUG_ON(!test_bit(FR_BACKGROUND, &req->flags));
585 if (!test_bit(FR_WAITING, &req->flags)) {
586 __set_bit(FR_WAITING, &req->flags);
587 atomic_inc(&fc->num_waiting);
588 }
589 __set_bit(FR_ISREPLY, &req->flags);
590 fc->num_background++;
591 if (fc->num_background == fc->max_background)
592 fc->blocked = 1;
593 if (fc->num_background == fc->congestion_threshold && fc->sb) {
594 set_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC);
595 set_bdi_congested(fc->sb->s_bdi, BLK_RW_ASYNC);
596 }
597 list_add_tail(&req->list, &fc->bg_queue);
598 flush_bg_queue(fc);
599 }
600
601 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
602 {
603 BUG_ON(!req->end);
604 spin_lock(&fc->lock);
605 if (fc->connected) {
606 fuse_request_send_background_locked(fc, req);
607 spin_unlock(&fc->lock);
608 } else {
609 spin_unlock(&fc->lock);
610 req->out.h.error = -ENOTCONN;
611 req->end(fc, req);
612 fuse_put_request(fc, req);
613 }
614 }
615 EXPORT_SYMBOL_GPL(fuse_request_send_background);
616
617 static int fuse_request_send_notify_reply(struct fuse_conn *fc,
618 struct fuse_req *req, u64 unique)
619 {
620 int err = -ENODEV;
621 struct fuse_iqueue *fiq = &fc->iq;
622
623 __clear_bit(FR_ISREPLY, &req->flags);
624 req->in.h.unique = unique;
625 spin_lock(&fiq->waitq.lock);
626 if (fiq->connected) {
627 queue_request(fiq, req);
628 err = 0;
629 }
630 spin_unlock(&fiq->waitq.lock);
631
632 return err;
633 }
634
635 void fuse_force_forget(struct file *file, u64 nodeid)
636 {
637 struct inode *inode = file_inode(file);
638 struct fuse_conn *fc = get_fuse_conn(inode);
639 struct fuse_req *req;
640 struct fuse_forget_in inarg;
641
642 memset(&inarg, 0, sizeof(inarg));
643 inarg.nlookup = 1;
644 req = fuse_get_req_nofail_nopages(fc, file);
645 req->in.h.opcode = FUSE_FORGET;
646 req->in.h.nodeid = nodeid;
647 req->in.numargs = 1;
648 req->in.args[0].size = sizeof(inarg);
649 req->in.args[0].value = &inarg;
650 __clear_bit(FR_ISREPLY, &req->flags);
651 __fuse_request_send(fc, req);
652 /* ignore errors */
653 fuse_put_request(fc, req);
654 }
655
656 /*
657 * Lock the request. Up to the next unlock_request() there mustn't be
658 * anything that could cause a page-fault. If the request was already
659 * aborted bail out.
660 */
661 static int lock_request(struct fuse_req *req)
662 {
663 int err = 0;
664 if (req) {
665 spin_lock(&req->waitq.lock);
666 if (test_bit(FR_ABORTED, &req->flags))
667 err = -ENOENT;
668 else
669 set_bit(FR_LOCKED, &req->flags);
670 spin_unlock(&req->waitq.lock);
671 }
672 return err;
673 }
674
675 /*
676 * Unlock request. If it was aborted while locked, caller is responsible
677 * for unlocking and ending the request.
678 */
679 static int unlock_request(struct fuse_req *req)
680 {
681 int err = 0;
682 if (req) {
683 spin_lock(&req->waitq.lock);
684 if (test_bit(FR_ABORTED, &req->flags))
685 err = -ENOENT;
686 else
687 clear_bit(FR_LOCKED, &req->flags);
688 spin_unlock(&req->waitq.lock);
689 }
690 return err;
691 }
692
693 struct fuse_copy_state {
694 int write;
695 struct fuse_req *req;
696 struct iov_iter *iter;
697 struct pipe_buffer *pipebufs;
698 struct pipe_buffer *currbuf;
699 struct pipe_inode_info *pipe;
700 unsigned long nr_segs;
701 struct page *pg;
702 unsigned len;
703 unsigned offset;
704 unsigned move_pages:1;
705 };
706
707 static void fuse_copy_init(struct fuse_copy_state *cs, int write,
708 struct iov_iter *iter)
709 {
710 memset(cs, 0, sizeof(*cs));
711 cs->write = write;
712 cs->iter = iter;
713 }
714
715 /* Unmap and put previous page of userspace buffer */
716 static void fuse_copy_finish(struct fuse_copy_state *cs)
717 {
718 if (cs->currbuf) {
719 struct pipe_buffer *buf = cs->currbuf;
720
721 if (cs->write)
722 buf->len = PAGE_SIZE - cs->len;
723 cs->currbuf = NULL;
724 } else if (cs->pg) {
725 if (cs->write) {
726 flush_dcache_page(cs->pg);
727 set_page_dirty_lock(cs->pg);
728 }
729 put_page(cs->pg);
730 }
731 cs->pg = NULL;
732 }
733
734 /*
735 * Get another pagefull of userspace buffer, and map it to kernel
736 * address space, and lock request
737 */
738 static int fuse_copy_fill(struct fuse_copy_state *cs)
739 {
740 struct page *page;
741 int err;
742
743 err = unlock_request(cs->req);
744 if (err)
745 return err;
746
747 fuse_copy_finish(cs);
748 if (cs->pipebufs) {
749 struct pipe_buffer *buf = cs->pipebufs;
750
751 if (!cs->write) {
752 err = pipe_buf_confirm(cs->pipe, buf);
753 if (err)
754 return err;
755
756 BUG_ON(!cs->nr_segs);
757 cs->currbuf = buf;
758 cs->pg = buf->page;
759 cs->offset = buf->offset;
760 cs->len = buf->len;
761 cs->pipebufs++;
762 cs->nr_segs--;
763 } else {
764 if (cs->nr_segs == cs->pipe->buffers)
765 return -EIO;
766
767 page = alloc_page(GFP_HIGHUSER);
768 if (!page)
769 return -ENOMEM;
770
771 buf->page = page;
772 buf->offset = 0;
773 buf->len = 0;
774
775 cs->currbuf = buf;
776 cs->pg = page;
777 cs->offset = 0;
778 cs->len = PAGE_SIZE;
779 cs->pipebufs++;
780 cs->nr_segs++;
781 }
782 } else {
783 size_t off;
784 err = iov_iter_get_pages(cs->iter, &page, PAGE_SIZE, 1, &off);
785 if (err < 0)
786 return err;
787 BUG_ON(!err);
788 cs->len = err;
789 cs->offset = off;
790 cs->pg = page;
791 iov_iter_advance(cs->iter, err);
792 }
793
794 return lock_request(cs->req);
795 }
796
797 /* Do as much copy to/from userspace buffer as we can */
798 static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
799 {
800 unsigned ncpy = min(*size, cs->len);
801 if (val) {
802 void *pgaddr = kmap_atomic(cs->pg);
803 void *buf = pgaddr + cs->offset;
804
805 if (cs->write)
806 memcpy(buf, *val, ncpy);
807 else
808 memcpy(*val, buf, ncpy);
809
810 kunmap_atomic(pgaddr);
811 *val += ncpy;
812 }
813 *size -= ncpy;
814 cs->len -= ncpy;
815 cs->offset += ncpy;
816 return ncpy;
817 }
818
819 static int fuse_check_page(struct page *page)
820 {
821 if (page_mapcount(page) ||
822 page->mapping != NULL ||
823 page_count(page) != 1 ||
824 (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
825 ~(1 << PG_locked |
826 1 << PG_referenced |
827 1 << PG_uptodate |
828 1 << PG_lru |
829 1 << PG_active |
830 1 << PG_reclaim))) {
831 printk(KERN_WARNING "fuse: trying to steal weird page\n");
832 printk(KERN_WARNING " page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
833 return 1;
834 }
835 return 0;
836 }
837
838 static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
839 {
840 int err;
841 struct page *oldpage = *pagep;
842 struct page *newpage;
843 struct pipe_buffer *buf = cs->pipebufs;
844
845 err = unlock_request(cs->req);
846 if (err)
847 return err;
848
849 fuse_copy_finish(cs);
850
851 err = pipe_buf_confirm(cs->pipe, buf);
852 if (err)
853 return err;
854
855 BUG_ON(!cs->nr_segs);
856 cs->currbuf = buf;
857 cs->len = buf->len;
858 cs->pipebufs++;
859 cs->nr_segs--;
860
861 if (cs->len != PAGE_SIZE)
862 goto out_fallback;
863
864 if (pipe_buf_steal(cs->pipe, buf) != 0)
865 goto out_fallback;
866
867 newpage = buf->page;
868
869 if (!PageUptodate(newpage))
870 SetPageUptodate(newpage);
871
872 ClearPageMappedToDisk(newpage);
873
874 if (fuse_check_page(newpage) != 0)
875 goto out_fallback_unlock;
876
877 /*
878 * This is a new and locked page, it shouldn't be mapped or
879 * have any special flags on it
880 */
881 if (WARN_ON(page_mapped(oldpage)))
882 goto out_fallback_unlock;
883 if (WARN_ON(page_has_private(oldpage)))
884 goto out_fallback_unlock;
885 if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
886 goto out_fallback_unlock;
887 if (WARN_ON(PageMlocked(oldpage)))
888 goto out_fallback_unlock;
889
890 err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
891 if (err) {
892 unlock_page(newpage);
893 return err;
894 }
895
896 get_page(newpage);
897
898 if (!(buf->flags & PIPE_BUF_FLAG_LRU))
899 lru_cache_add_file(newpage);
900
901 err = 0;
902 spin_lock(&cs->req->waitq.lock);
903 if (test_bit(FR_ABORTED, &cs->req->flags))
904 err = -ENOENT;
905 else
906 *pagep = newpage;
907 spin_unlock(&cs->req->waitq.lock);
908
909 if (err) {
910 unlock_page(newpage);
911 put_page(newpage);
912 return err;
913 }
914
915 unlock_page(oldpage);
916 put_page(oldpage);
917 cs->len = 0;
918
919 return 0;
920
921 out_fallback_unlock:
922 unlock_page(newpage);
923 out_fallback:
924 cs->pg = buf->page;
925 cs->offset = buf->offset;
926
927 err = lock_request(cs->req);
928 if (err)
929 return err;
930
931 return 1;
932 }
933
934 static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
935 unsigned offset, unsigned count)
936 {
937 struct pipe_buffer *buf;
938 int err;
939
940 if (cs->nr_segs == cs->pipe->buffers)
941 return -EIO;
942
943 err = unlock_request(cs->req);
944 if (err)
945 return err;
946
947 fuse_copy_finish(cs);
948
949 buf = cs->pipebufs;
950 get_page(page);
951 buf->page = page;
952 buf->offset = offset;
953 buf->len = count;
954
955 cs->pipebufs++;
956 cs->nr_segs++;
957 cs->len = 0;
958
959 return 0;
960 }
961
962 /*
963 * Copy a page in the request to/from the userspace buffer. Must be
964 * done atomically
965 */
966 static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
967 unsigned offset, unsigned count, int zeroing)
968 {
969 int err;
970 struct page *page = *pagep;
971
972 if (page && zeroing && count < PAGE_SIZE)
973 clear_highpage(page);
974
975 while (count) {
976 if (cs->write && cs->pipebufs && page) {
977 return fuse_ref_page(cs, page, offset, count);
978 } else if (!cs->len) {
979 if (cs->move_pages && page &&
980 offset == 0 && count == PAGE_SIZE) {
981 err = fuse_try_move_page(cs, pagep);
982 if (err <= 0)
983 return err;
984 } else {
985 err = fuse_copy_fill(cs);
986 if (err)
987 return err;
988 }
989 }
990 if (page) {
991 void *mapaddr = kmap_atomic(page);
992 void *buf = mapaddr + offset;
993 offset += fuse_copy_do(cs, &buf, &count);
994 kunmap_atomic(mapaddr);
995 } else
996 offset += fuse_copy_do(cs, NULL, &count);
997 }
998 if (page && !cs->write)
999 flush_dcache_page(page);
1000 return 0;
1001 }
1002
1003 /* Copy pages in the request to/from userspace buffer */
1004 static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
1005 int zeroing)
1006 {
1007 unsigned i;
1008 struct fuse_req *req = cs->req;
1009
1010 for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
1011 int err;
1012 unsigned offset = req->page_descs[i].offset;
1013 unsigned count = min(nbytes, req->page_descs[i].length);
1014
1015 err = fuse_copy_page(cs, &req->pages[i], offset, count,
1016 zeroing);
1017 if (err)
1018 return err;
1019
1020 nbytes -= count;
1021 }
1022 return 0;
1023 }
1024
1025 /* Copy a single argument in the request to/from userspace buffer */
1026 static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
1027 {
1028 while (size) {
1029 if (!cs->len) {
1030 int err = fuse_copy_fill(cs);
1031 if (err)
1032 return err;
1033 }
1034 fuse_copy_do(cs, &val, &size);
1035 }
1036 return 0;
1037 }
1038
1039 /* Copy request arguments to/from userspace buffer */
1040 static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
1041 unsigned argpages, struct fuse_arg *args,
1042 int zeroing)
1043 {
1044 int err = 0;
1045 unsigned i;
1046
1047 for (i = 0; !err && i < numargs; i++) {
1048 struct fuse_arg *arg = &args[i];
1049 if (i == numargs - 1 && argpages)
1050 err = fuse_copy_pages(cs, arg->size, zeroing);
1051 else
1052 err = fuse_copy_one(cs, arg->value, arg->size);
1053 }
1054 return err;
1055 }
1056
1057 static int forget_pending(struct fuse_iqueue *fiq)
1058 {
1059 return fiq->forget_list_head.next != NULL;
1060 }
1061
1062 static int request_pending(struct fuse_iqueue *fiq)
1063 {
1064 return !list_empty(&fiq->pending) || !list_empty(&fiq->interrupts) ||
1065 forget_pending(fiq);
1066 }
1067
1068 /*
1069 * Transfer an interrupt request to userspace
1070 *
1071 * Unlike other requests this is assembled on demand, without a need
1072 * to allocate a separate fuse_req structure.
1073 *
1074 * Called with fiq->waitq.lock held, releases it
1075 */
1076 static int fuse_read_interrupt(struct fuse_iqueue *fiq,
1077 struct fuse_copy_state *cs,
1078 size_t nbytes, struct fuse_req *req)
1079 __releases(fiq->waitq.lock)
1080 {
1081 struct fuse_in_header ih;
1082 struct fuse_interrupt_in arg;
1083 unsigned reqsize = sizeof(ih) + sizeof(arg);
1084 int err;
1085
1086 list_del_init(&req->intr_entry);
1087 req->intr_unique = fuse_get_unique(fiq);
1088 memset(&ih, 0, sizeof(ih));
1089 memset(&arg, 0, sizeof(arg));
1090 ih.len = reqsize;
1091 ih.opcode = FUSE_INTERRUPT;
1092 ih.unique = req->intr_unique;
1093 arg.unique = req->in.h.unique;
1094
1095 spin_unlock(&fiq->waitq.lock);
1096 if (nbytes < reqsize)
1097 return -EINVAL;
1098
1099 err = fuse_copy_one(cs, &ih, sizeof(ih));
1100 if (!err)
1101 err = fuse_copy_one(cs, &arg, sizeof(arg));
1102 fuse_copy_finish(cs);
1103
1104 return err ? err : reqsize;
1105 }
1106
1107 static struct fuse_forget_link *dequeue_forget(struct fuse_iqueue *fiq,
1108 unsigned max,
1109 unsigned *countp)
1110 {
1111 struct fuse_forget_link *head = fiq->forget_list_head.next;
1112 struct fuse_forget_link **newhead = &head;
1113 unsigned count;
1114
1115 for (count = 0; *newhead != NULL && count < max; count++)
1116 newhead = &(*newhead)->next;
1117
1118 fiq->forget_list_head.next = *newhead;
1119 *newhead = NULL;
1120 if (fiq->forget_list_head.next == NULL)
1121 fiq->forget_list_tail = &fiq->forget_list_head;
1122
1123 if (countp != NULL)
1124 *countp = count;
1125
1126 return head;
1127 }
1128
1129 static int fuse_read_single_forget(struct fuse_iqueue *fiq,
1130 struct fuse_copy_state *cs,
1131 size_t nbytes)
1132 __releases(fiq->waitq.lock)
1133 {
1134 int err;
1135 struct fuse_forget_link *forget = dequeue_forget(fiq, 1, NULL);
1136 struct fuse_forget_in arg = {
1137 .nlookup = forget->forget_one.nlookup,
1138 };
1139 struct fuse_in_header ih = {
1140 .opcode = FUSE_FORGET,
1141 .nodeid = forget->forget_one.nodeid,
1142 .unique = fuse_get_unique(fiq),
1143 .len = sizeof(ih) + sizeof(arg),
1144 };
1145
1146 spin_unlock(&fiq->waitq.lock);
1147 kfree(forget);
1148 if (nbytes < ih.len)
1149 return -EINVAL;
1150
1151 err = fuse_copy_one(cs, &ih, sizeof(ih));
1152 if (!err)
1153 err = fuse_copy_one(cs, &arg, sizeof(arg));
1154 fuse_copy_finish(cs);
1155
1156 if (err)
1157 return err;
1158
1159 return ih.len;
1160 }
1161
1162 static int fuse_read_batch_forget(struct fuse_iqueue *fiq,
1163 struct fuse_copy_state *cs, size_t nbytes)
1164 __releases(fiq->waitq.lock)
1165 {
1166 int err;
1167 unsigned max_forgets;
1168 unsigned count;
1169 struct fuse_forget_link *head;
1170 struct fuse_batch_forget_in arg = { .count = 0 };
1171 struct fuse_in_header ih = {
1172 .opcode = FUSE_BATCH_FORGET,
1173 .unique = fuse_get_unique(fiq),
1174 .len = sizeof(ih) + sizeof(arg),
1175 };
1176
1177 if (nbytes < ih.len) {
1178 spin_unlock(&fiq->waitq.lock);
1179 return -EINVAL;
1180 }
1181
1182 max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
1183 head = dequeue_forget(fiq, max_forgets, &count);
1184 spin_unlock(&fiq->waitq.lock);
1185
1186 arg.count = count;
1187 ih.len += count * sizeof(struct fuse_forget_one);
1188 err = fuse_copy_one(cs, &ih, sizeof(ih));
1189 if (!err)
1190 err = fuse_copy_one(cs, &arg, sizeof(arg));
1191
1192 while (head) {
1193 struct fuse_forget_link *forget = head;
1194
1195 if (!err) {
1196 err = fuse_copy_one(cs, &forget->forget_one,
1197 sizeof(forget->forget_one));
1198 }
1199 head = forget->next;
1200 kfree(forget);
1201 }
1202
1203 fuse_copy_finish(cs);
1204
1205 if (err)
1206 return err;
1207
1208 return ih.len;
1209 }
1210
1211 static int fuse_read_forget(struct fuse_conn *fc, struct fuse_iqueue *fiq,
1212 struct fuse_copy_state *cs,
1213 size_t nbytes)
1214 __releases(fiq->waitq.lock)
1215 {
1216 if (fc->minor < 16 || fiq->forget_list_head.next->next == NULL)
1217 return fuse_read_single_forget(fiq, cs, nbytes);
1218 else
1219 return fuse_read_batch_forget(fiq, cs, nbytes);
1220 }
1221
1222 /*
1223 * Read a single request into the userspace filesystem's buffer. This
1224 * function waits until a request is available, then removes it from
1225 * the pending list and copies request data to userspace buffer. If
1226 * no reply is needed (FORGET) or request has been aborted or there
1227 * was an error during the copying then it's finished by calling
1228 * request_end(). Otherwise add it to the processing list, and set
1229 * the 'sent' flag.
1230 */
1231 static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
1232 struct fuse_copy_state *cs, size_t nbytes)
1233 {
1234 ssize_t err;
1235 struct fuse_conn *fc = fud->fc;
1236 struct fuse_iqueue *fiq = &fc->iq;
1237 struct fuse_pqueue *fpq = &fud->pq;
1238 struct fuse_req *req;
1239 struct fuse_in *in;
1240 unsigned reqsize;
1241
1242 restart:
1243 spin_lock(&fiq->waitq.lock);
1244 err = -EAGAIN;
1245 if ((file->f_flags & O_NONBLOCK) && fiq->connected &&
1246 !request_pending(fiq))
1247 goto err_unlock;
1248
1249 err = wait_event_interruptible_exclusive_locked(fiq->waitq,
1250 !fiq->connected || request_pending(fiq));
1251 if (err)
1252 goto err_unlock;
1253
1254 if (!fiq->connected) {
1255 err = (fc->aborted && fc->abort_err) ? -ECONNABORTED : -ENODEV;
1256 goto err_unlock;
1257 }
1258
1259 if (!list_empty(&fiq->interrupts)) {
1260 req = list_entry(fiq->interrupts.next, struct fuse_req,
1261 intr_entry);
1262 return fuse_read_interrupt(fiq, cs, nbytes, req);
1263 }
1264
1265 if (forget_pending(fiq)) {
1266 if (list_empty(&fiq->pending) || fiq->forget_batch-- > 0)
1267 return fuse_read_forget(fc, fiq, cs, nbytes);
1268
1269 if (fiq->forget_batch <= -8)
1270 fiq->forget_batch = 16;
1271 }
1272
1273 req = list_entry(fiq->pending.next, struct fuse_req, list);
1274 clear_bit(FR_PENDING, &req->flags);
1275 list_del_init(&req->list);
1276 spin_unlock(&fiq->waitq.lock);
1277
1278 in = &req->in;
1279 reqsize = in->h.len;
1280
1281 /* If request is too large, reply with an error and restart the read */
1282 if (nbytes < reqsize) {
1283 req->out.h.error = -EIO;
1284 /* SETXATTR is special, since it may contain too large data */
1285 if (in->h.opcode == FUSE_SETXATTR)
1286 req->out.h.error = -E2BIG;
1287 request_end(fc, req);
1288 goto restart;
1289 }
1290 spin_lock(&fpq->lock);
1291 list_add(&req->list, &fpq->io);
1292 spin_unlock(&fpq->lock);
1293 cs->req = req;
1294 err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1295 if (!err)
1296 err = fuse_copy_args(cs, in->numargs, in->argpages,
1297 (struct fuse_arg *) in->args, 0);
1298 fuse_copy_finish(cs);
1299 spin_lock(&fpq->lock);
1300 clear_bit(FR_LOCKED, &req->flags);
1301 if (!fpq->connected) {
1302 err = (fc->aborted && fc->abort_err) ? -ECONNABORTED : -ENODEV;
1303 goto out_end;
1304 }
1305 if (err) {
1306 req->out.h.error = -EIO;
1307 goto out_end;
1308 }
1309 if (!test_bit(FR_ISREPLY, &req->flags)) {
1310 err = reqsize;
1311 goto out_end;
1312 }
1313 list_move_tail(&req->list, &fpq->processing);
1314 __fuse_get_request(req);
1315 set_bit(FR_SENT, &req->flags);
1316 spin_unlock(&fpq->lock);
1317 /* matches barrier in request_wait_answer() */
1318 smp_mb__after_atomic();
1319 if (test_bit(FR_INTERRUPTED, &req->flags))
1320 queue_interrupt(fiq, req);
1321 fuse_put_request(fc, req);
1322
1323 return reqsize;
1324
1325 out_end:
1326 if (!test_bit(FR_PRIVATE, &req->flags))
1327 list_del_init(&req->list);
1328 spin_unlock(&fpq->lock);
1329 request_end(fc, req);
1330 return err;
1331
1332 err_unlock:
1333 spin_unlock(&fiq->waitq.lock);
1334 return err;
1335 }
1336
1337 static int fuse_dev_open(struct inode *inode, struct file *file)
1338 {
1339 /*
1340 * The fuse device's file's private_data is used to hold
1341 * the fuse_conn(ection) when it is mounted, and is used to
1342 * keep track of whether the file has been mounted already.
1343 */
1344 file->private_data = NULL;
1345 return 0;
1346 }
1347
1348 static ssize_t fuse_dev_read(struct kiocb *iocb, struct iov_iter *to)
1349 {
1350 struct fuse_copy_state cs;
1351 struct file *file = iocb->ki_filp;
1352 struct fuse_dev *fud = fuse_get_dev(file);
1353
1354 if (!fud)
1355 return -EPERM;
1356
1357 if (!iter_is_iovec(to))
1358 return -EINVAL;
1359
1360 fuse_copy_init(&cs, 1, to);
1361
1362 return fuse_dev_do_read(fud, file, &cs, iov_iter_count(to));
1363 }
1364
1365 static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1366 struct pipe_inode_info *pipe,
1367 size_t len, unsigned int flags)
1368 {
1369 int total, ret;
1370 int page_nr = 0;
1371 struct pipe_buffer *bufs;
1372 struct fuse_copy_state cs;
1373 struct fuse_dev *fud = fuse_get_dev(in);
1374
1375 if (!fud)
1376 return -EPERM;
1377
1378 bufs = kvmalloc_array(pipe->buffers, sizeof(struct pipe_buffer),
1379 GFP_KERNEL);
1380 if (!bufs)
1381 return -ENOMEM;
1382
1383 fuse_copy_init(&cs, 1, NULL);
1384 cs.pipebufs = bufs;
1385 cs.pipe = pipe;
1386 ret = fuse_dev_do_read(fud, in, &cs, len);
1387 if (ret < 0)
1388 goto out;
1389
1390 if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
1391 ret = -EIO;
1392 goto out;
1393 }
1394
1395 for (ret = total = 0; page_nr < cs.nr_segs; total += ret) {
1396 /*
1397 * Need to be careful about this. Having buf->ops in module
1398 * code can Oops if the buffer persists after module unload.
1399 */
1400 bufs[page_nr].ops = &nosteal_pipe_buf_ops;
1401 bufs[page_nr].flags = 0;
1402 ret = add_to_pipe(pipe, &bufs[page_nr++]);
1403 if (unlikely(ret < 0))
1404 break;
1405 }
1406 if (total)
1407 ret = total;
1408 out:
1409 for (; page_nr < cs.nr_segs; page_nr++)
1410 put_page(bufs[page_nr].page);
1411
1412 kvfree(bufs);
1413 return ret;
1414 }
1415
1416 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
1417 struct fuse_copy_state *cs)
1418 {
1419 struct fuse_notify_poll_wakeup_out outarg;
1420 int err = -EINVAL;
1421
1422 if (size != sizeof(outarg))
1423 goto err;
1424
1425 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1426 if (err)
1427 goto err;
1428
1429 fuse_copy_finish(cs);
1430 return fuse_notify_poll_wakeup(fc, &outarg);
1431
1432 err:
1433 fuse_copy_finish(cs);
1434 return err;
1435 }
1436
1437 static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
1438 struct fuse_copy_state *cs)
1439 {
1440 struct fuse_notify_inval_inode_out outarg;
1441 int err = -EINVAL;
1442
1443 if (size != sizeof(outarg))
1444 goto err;
1445
1446 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1447 if (err)
1448 goto err;
1449 fuse_copy_finish(cs);
1450
1451 down_read(&fc->killsb);
1452 err = -ENOENT;
1453 if (fc->sb) {
1454 err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
1455 outarg.off, outarg.len);
1456 }
1457 up_read(&fc->killsb);
1458 return err;
1459
1460 err:
1461 fuse_copy_finish(cs);
1462 return err;
1463 }
1464
1465 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
1466 struct fuse_copy_state *cs)
1467 {
1468 struct fuse_notify_inval_entry_out outarg;
1469 int err = -ENOMEM;
1470 char *buf;
1471 struct qstr name;
1472
1473 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1474 if (!buf)
1475 goto err;
1476
1477 err = -EINVAL;
1478 if (size < sizeof(outarg))
1479 goto err;
1480
1481 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1482 if (err)
1483 goto err;
1484
1485 err = -ENAMETOOLONG;
1486 if (outarg.namelen > FUSE_NAME_MAX)
1487 goto err;
1488
1489 err = -EINVAL;
1490 if (size != sizeof(outarg) + outarg.namelen + 1)
1491 goto err;
1492
1493 name.name = buf;
1494 name.len = outarg.namelen;
1495 err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1496 if (err)
1497 goto err;
1498 fuse_copy_finish(cs);
1499 buf[outarg.namelen] = 0;
1500
1501 down_read(&fc->killsb);
1502 err = -ENOENT;
1503 if (fc->sb)
1504 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
1505 up_read(&fc->killsb);
1506 kfree(buf);
1507 return err;
1508
1509 err:
1510 kfree(buf);
1511 fuse_copy_finish(cs);
1512 return err;
1513 }
1514
1515 static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
1516 struct fuse_copy_state *cs)
1517 {
1518 struct fuse_notify_delete_out outarg;
1519 int err = -ENOMEM;
1520 char *buf;
1521 struct qstr name;
1522
1523 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1524 if (!buf)
1525 goto err;
1526
1527 err = -EINVAL;
1528 if (size < sizeof(outarg))
1529 goto err;
1530
1531 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1532 if (err)
1533 goto err;
1534
1535 err = -ENAMETOOLONG;
1536 if (outarg.namelen > FUSE_NAME_MAX)
1537 goto err;
1538
1539 err = -EINVAL;
1540 if (size != sizeof(outarg) + outarg.namelen + 1)
1541 goto err;
1542
1543 name.name = buf;
1544 name.len = outarg.namelen;
1545 err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1546 if (err)
1547 goto err;
1548 fuse_copy_finish(cs);
1549 buf[outarg.namelen] = 0;
1550
1551 down_read(&fc->killsb);
1552 err = -ENOENT;
1553 if (fc->sb)
1554 err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
1555 outarg.child, &name);
1556 up_read(&fc->killsb);
1557 kfree(buf);
1558 return err;
1559
1560 err:
1561 kfree(buf);
1562 fuse_copy_finish(cs);
1563 return err;
1564 }
1565
1566 static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
1567 struct fuse_copy_state *cs)
1568 {
1569 struct fuse_notify_store_out outarg;
1570 struct inode *inode;
1571 struct address_space *mapping;
1572 u64 nodeid;
1573 int err;
1574 pgoff_t index;
1575 unsigned int offset;
1576 unsigned int num;
1577 loff_t file_size;
1578 loff_t end;
1579
1580 err = -EINVAL;
1581 if (size < sizeof(outarg))
1582 goto out_finish;
1583
1584 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1585 if (err)
1586 goto out_finish;
1587
1588 err = -EINVAL;
1589 if (size - sizeof(outarg) != outarg.size)
1590 goto out_finish;
1591
1592 nodeid = outarg.nodeid;
1593
1594 down_read(&fc->killsb);
1595
1596 err = -ENOENT;
1597 if (!fc->sb)
1598 goto out_up_killsb;
1599
1600 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1601 if (!inode)
1602 goto out_up_killsb;
1603
1604 mapping = inode->i_mapping;
1605 index = outarg.offset >> PAGE_SHIFT;
1606 offset = outarg.offset & ~PAGE_MASK;
1607 file_size = i_size_read(inode);
1608 end = outarg.offset + outarg.size;
1609 if (end > file_size) {
1610 file_size = end;
1611 fuse_write_update_size(inode, file_size);
1612 }
1613
1614 num = outarg.size;
1615 while (num) {
1616 struct page *page;
1617 unsigned int this_num;
1618
1619 err = -ENOMEM;
1620 page = find_or_create_page(mapping, index,
1621 mapping_gfp_mask(mapping));
1622 if (!page)
1623 goto out_iput;
1624
1625 this_num = min_t(unsigned, num, PAGE_SIZE - offset);
1626 err = fuse_copy_page(cs, &page, offset, this_num, 0);
1627 if (!err && offset == 0 &&
1628 (this_num == PAGE_SIZE || file_size == end))
1629 SetPageUptodate(page);
1630 unlock_page(page);
1631 put_page(page);
1632
1633 if (err)
1634 goto out_iput;
1635
1636 num -= this_num;
1637 offset = 0;
1638 index++;
1639 }
1640
1641 err = 0;
1642
1643 out_iput:
1644 iput(inode);
1645 out_up_killsb:
1646 up_read(&fc->killsb);
1647 out_finish:
1648 fuse_copy_finish(cs);
1649 return err;
1650 }
1651
1652 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
1653 {
1654 release_pages(req->pages, req->num_pages);
1655 }
1656
1657 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
1658 struct fuse_notify_retrieve_out *outarg)
1659 {
1660 int err;
1661 struct address_space *mapping = inode->i_mapping;
1662 struct fuse_req *req;
1663 pgoff_t index;
1664 loff_t file_size;
1665 unsigned int num;
1666 unsigned int offset;
1667 size_t total_len = 0;
1668 int num_pages;
1669
1670 offset = outarg->offset & ~PAGE_MASK;
1671 file_size = i_size_read(inode);
1672
1673 num = outarg->size;
1674 if (outarg->offset > file_size)
1675 num = 0;
1676 else if (outarg->offset + num > file_size)
1677 num = file_size - outarg->offset;
1678
1679 num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1680 num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);
1681
1682 req = fuse_get_req(fc, num_pages);
1683 if (IS_ERR(req))
1684 return PTR_ERR(req);
1685
1686 req->in.h.opcode = FUSE_NOTIFY_REPLY;
1687 req->in.h.nodeid = outarg->nodeid;
1688 req->in.numargs = 2;
1689 req->in.argpages = 1;
1690 req->page_descs[0].offset = offset;
1691 req->end = fuse_retrieve_end;
1692
1693 index = outarg->offset >> PAGE_SHIFT;
1694
1695 while (num && req->num_pages < num_pages) {
1696 struct page *page;
1697 unsigned int this_num;
1698
1699 page = find_get_page(mapping, index);
1700 if (!page)
1701 break;
1702
1703 this_num = min_t(unsigned, num, PAGE_SIZE - offset);
1704 req->pages[req->num_pages] = page;
1705 req->page_descs[req->num_pages].length = this_num;
1706 req->num_pages++;
1707
1708 offset = 0;
1709 num -= this_num;
1710 total_len += this_num;
1711 index++;
1712 }
1713 req->misc.retrieve_in.offset = outarg->offset;
1714 req->misc.retrieve_in.size = total_len;
1715 req->in.args[0].size = sizeof(req->misc.retrieve_in);
1716 req->in.args[0].value = &req->misc.retrieve_in;
1717 req->in.args[1].size = total_len;
1718
1719 err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
1720 if (err)
1721 fuse_retrieve_end(fc, req);
1722
1723 return err;
1724 }
1725
1726 static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
1727 struct fuse_copy_state *cs)
1728 {
1729 struct fuse_notify_retrieve_out outarg;
1730 struct inode *inode;
1731 int err;
1732
1733 err = -EINVAL;
1734 if (size != sizeof(outarg))
1735 goto copy_finish;
1736
1737 err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1738 if (err)
1739 goto copy_finish;
1740
1741 fuse_copy_finish(cs);
1742
1743 down_read(&fc->killsb);
1744 err = -ENOENT;
1745 if (fc->sb) {
1746 u64 nodeid = outarg.nodeid;
1747
1748 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1749 if (inode) {
1750 err = fuse_retrieve(fc, inode, &outarg);
1751 iput(inode);
1752 }
1753 }
1754 up_read(&fc->killsb);
1755
1756 return err;
1757
1758 copy_finish:
1759 fuse_copy_finish(cs);
1760 return err;
1761 }
1762
1763 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
1764 unsigned int size, struct fuse_copy_state *cs)
1765 {
1766 /* Don't try to move pages (yet) */
1767 cs->move_pages = 0;
1768
1769 switch (code) {
1770 case FUSE_NOTIFY_POLL:
1771 return fuse_notify_poll(fc, size, cs);
1772
1773 case FUSE_NOTIFY_INVAL_INODE:
1774 return fuse_notify_inval_inode(fc, size, cs);
1775
1776 case FUSE_NOTIFY_INVAL_ENTRY:
1777 return fuse_notify_inval_entry(fc, size, cs);
1778
1779 case FUSE_NOTIFY_STORE:
1780 return fuse_notify_store(fc, size, cs);
1781
1782 case FUSE_NOTIFY_RETRIEVE:
1783 return fuse_notify_retrieve(fc, size, cs);
1784
1785 case FUSE_NOTIFY_DELETE:
1786 return fuse_notify_delete(fc, size, cs);
1787
1788 default:
1789 fuse_copy_finish(cs);
1790 return -EINVAL;
1791 }
1792 }
1793
1794 /* Look up request on processing list by unique ID */
1795 static struct fuse_req *request_find(struct fuse_pqueue *fpq, u64 unique)
1796 {
1797 struct fuse_req *req;
1798
1799 list_for_each_entry(req, &fpq->processing, list) {
1800 if (req->in.h.unique == unique || req->intr_unique == unique)
1801 return req;
1802 }
1803 return NULL;
1804 }
1805
1806 static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
1807 unsigned nbytes)
1808 {
1809 unsigned reqsize = sizeof(struct fuse_out_header);
1810
1811 if (out->h.error)
1812 return nbytes != reqsize ? -EINVAL : 0;
1813
1814 reqsize += len_args(out->numargs, out->args);
1815
1816 if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
1817 return -EINVAL;
1818 else if (reqsize > nbytes) {
1819 struct fuse_arg *lastarg = &out->args[out->numargs-1];
1820 unsigned diffsize = reqsize - nbytes;
1821 if (diffsize > lastarg->size)
1822 return -EINVAL;
1823 lastarg->size -= diffsize;
1824 }
1825 return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
1826 out->page_zeroing);
1827 }
1828
1829 /*
1830 * Write a single reply to a request. First the header is copied from
1831 * the write buffer. The request is then searched on the processing
1832 * list by the unique ID found in the header. If found, then remove
1833 * it from the list and copy the rest of the buffer to the request.
1834 * The request is finished by calling request_end()
1835 */
1836 static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
1837 struct fuse_copy_state *cs, size_t nbytes)
1838 {
1839 int err;
1840 struct fuse_conn *fc = fud->fc;
1841 struct fuse_pqueue *fpq = &fud->pq;
1842 struct fuse_req *req;
1843 struct fuse_out_header oh;
1844
1845 if (nbytes < sizeof(struct fuse_out_header))
1846 return -EINVAL;
1847
1848 err = fuse_copy_one(cs, &oh, sizeof(oh));
1849 if (err)
1850 goto err_finish;
1851
1852 err = -EINVAL;
1853 if (oh.len != nbytes)
1854 goto err_finish;
1855
1856 /*
1857 * Zero oh.unique indicates unsolicited notification message
1858 * and error contains notification code.
1859 */
1860 if (!oh.unique) {
1861 err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1862 return err ? err : nbytes;
1863 }
1864
1865 err = -EINVAL;
1866 if (oh.error <= -1000 || oh.error > 0)
1867 goto err_finish;
1868
1869 spin_lock(&fpq->lock);
1870 err = -ENOENT;
1871 if (!fpq->connected)
1872 goto err_unlock_pq;
1873
1874 req = request_find(fpq, oh.unique);
1875 if (!req)
1876 goto err_unlock_pq;
1877
1878 /* Is it an interrupt reply? */
1879 if (req->intr_unique == oh.unique) {
1880 __fuse_get_request(req);
1881 spin_unlock(&fpq->lock);
1882
1883 err = -EINVAL;
1884 if (nbytes != sizeof(struct fuse_out_header)) {
1885 fuse_put_request(fc, req);
1886 goto err_finish;
1887 }
1888
1889 if (oh.error == -ENOSYS)
1890 fc->no_interrupt = 1;
1891 else if (oh.error == -EAGAIN)
1892 queue_interrupt(&fc->iq, req);
1893 fuse_put_request(fc, req);
1894
1895 fuse_copy_finish(cs);
1896 return nbytes;
1897 }
1898
1899 clear_bit(FR_SENT, &req->flags);
1900 list_move(&req->list, &fpq->io);
1901 req->out.h = oh;
1902 set_bit(FR_LOCKED, &req->flags);
1903 spin_unlock(&fpq->lock);
1904 cs->req = req;
1905 if (!req->out.page_replace)
1906 cs->move_pages = 0;
1907
1908 err = copy_out_args(cs, &req->out, nbytes);
1909 fuse_copy_finish(cs);
1910
1911 spin_lock(&fpq->lock);
1912 clear_bit(FR_LOCKED, &req->flags);
1913 if (!fpq->connected)
1914 err = -ENOENT;
1915 else if (err)
1916 req->out.h.error = -EIO;
1917 if (!test_bit(FR_PRIVATE, &req->flags))
1918 list_del_init(&req->list);
1919 spin_unlock(&fpq->lock);
1920
1921 request_end(fc, req);
1922
1923 return err ? err : nbytes;
1924
1925 err_unlock_pq:
1926 spin_unlock(&fpq->lock);
1927 err_finish:
1928 fuse_copy_finish(cs);
1929 return err;
1930 }
1931
1932 static ssize_t fuse_dev_write(struct kiocb *iocb, struct iov_iter *from)
1933 {
1934 struct fuse_copy_state cs;
1935 struct fuse_dev *fud = fuse_get_dev(iocb->ki_filp);
1936
1937 if (!fud)
1938 return -EPERM;
1939
1940 if (!iter_is_iovec(from))
1941 return -EINVAL;
1942
1943 fuse_copy_init(&cs, 0, from);
1944
1945 return fuse_dev_do_write(fud, &cs, iov_iter_count(from));
1946 }
1947
1948 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
1949 struct file *out, loff_t *ppos,
1950 size_t len, unsigned int flags)
1951 {
1952 unsigned nbuf;
1953 unsigned idx;
1954 struct pipe_buffer *bufs;
1955 struct fuse_copy_state cs;
1956 struct fuse_dev *fud;
1957 size_t rem;
1958 ssize_t ret;
1959
1960 fud = fuse_get_dev(out);
1961 if (!fud)
1962 return -EPERM;
1963
1964 pipe_lock(pipe);
1965
1966 bufs = kvmalloc_array(pipe->nrbufs, sizeof(struct pipe_buffer),
1967 GFP_KERNEL);
1968 if (!bufs) {
1969 pipe_unlock(pipe);
1970 return -ENOMEM;
1971 }
1972
1973 nbuf = 0;
1974 rem = 0;
1975 for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
1976 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
1977
1978 ret = -EINVAL;
1979 if (rem < len) {
1980 pipe_unlock(pipe);
1981 goto out;
1982 }
1983
1984 rem = len;
1985 while (rem) {
1986 struct pipe_buffer *ibuf;
1987 struct pipe_buffer *obuf;
1988
1989 BUG_ON(nbuf >= pipe->buffers);
1990 BUG_ON(!pipe->nrbufs);
1991 ibuf = &pipe->bufs[pipe->curbuf];
1992 obuf = &bufs[nbuf];
1993
1994 if (rem >= ibuf->len) {
1995 *obuf = *ibuf;
1996 ibuf->ops = NULL;
1997 pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
1998 pipe->nrbufs--;
1999 } else {
2000 pipe_buf_get(pipe, ibuf);
2001 *obuf = *ibuf;
2002 obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
2003 obuf->len = rem;
2004 ibuf->offset += obuf->len;
2005 ibuf->len -= obuf->len;
2006 }
2007 nbuf++;
2008 rem -= obuf->len;
2009 }
2010 pipe_unlock(pipe);
2011
2012 fuse_copy_init(&cs, 0, NULL);
2013 cs.pipebufs = bufs;
2014 cs.nr_segs = nbuf;
2015 cs.pipe = pipe;
2016
2017 if (flags & SPLICE_F_MOVE)
2018 cs.move_pages = 1;
2019
2020 ret = fuse_dev_do_write(fud, &cs, len);
2021
2022 for (idx = 0; idx < nbuf; idx++)
2023 pipe_buf_release(pipe, &bufs[idx]);
2024
2025 out:
2026 kvfree(bufs);
2027 return ret;
2028 }
2029
2030 static __poll_t fuse_dev_poll(struct file *file, poll_table *wait)
2031 {
2032 __poll_t mask = EPOLLOUT | EPOLLWRNORM;
2033 struct fuse_iqueue *fiq;
2034 struct fuse_dev *fud = fuse_get_dev(file);
2035
2036 if (!fud)
2037 return EPOLLERR;
2038
2039 fiq = &fud->fc->iq;
2040 poll_wait(file, &fiq->waitq, wait);
2041
2042 spin_lock(&fiq->waitq.lock);
2043 if (!fiq->connected)
2044 mask = EPOLLERR;
2045 else if (request_pending(fiq))
2046 mask |= EPOLLIN | EPOLLRDNORM;
2047 spin_unlock(&fiq->waitq.lock);
2048
2049 return mask;
2050 }
2051
2052 /*
2053 * Abort all requests on the given list (pending or processing)
2054 *
2055 * This function releases and reacquires fc->lock
2056 */
2057 static void end_requests(struct fuse_conn *fc, struct list_head *head)
2058 {
2059 while (!list_empty(head)) {
2060 struct fuse_req *req;
2061 req = list_entry(head->next, struct fuse_req, list);
2062 req->out.h.error = -ECONNABORTED;
2063 clear_bit(FR_SENT, &req->flags);
2064 list_del_init(&req->list);
2065 request_end(fc, req);
2066 }
2067 }
2068
2069 static void end_polls(struct fuse_conn *fc)
2070 {
2071 struct rb_node *p;
2072
2073 p = rb_first(&fc->polled_files);
2074
2075 while (p) {
2076 struct fuse_file *ff;
2077 ff = rb_entry(p, struct fuse_file, polled_node);
2078 wake_up_interruptible_all(&ff->poll_wait);
2079
2080 p = rb_next(p);
2081 }
2082 }
2083
2084 /*
2085 * Abort all requests.
2086 *
2087 * Emergency exit in case of a malicious or accidental deadlock, or just a hung
2088 * filesystem.
2089 *
2090 * The same effect is usually achievable through killing the filesystem daemon
2091 * and all users of the filesystem. The exception is the combination of an
2092 * asynchronous request and the tricky deadlock (see
2093 * Documentation/filesystems/fuse.txt).
2094 *
2095 * Aborting requests under I/O goes as follows: 1: Separate out unlocked
2096 * requests, they should be finished off immediately. Locked requests will be
2097 * finished after unlock; see unlock_request(). 2: Finish off the unlocked
2098 * requests. It is possible that some request will finish before we can. This
2099 * is OK, the request will in that case be removed from the list before we touch
2100 * it.
2101 */
2102 void fuse_abort_conn(struct fuse_conn *fc, bool is_abort)
2103 {
2104 struct fuse_iqueue *fiq = &fc->iq;
2105
2106 spin_lock(&fc->lock);
2107 if (fc->connected) {
2108 struct fuse_dev *fud;
2109 struct fuse_req *req, *next;
2110 LIST_HEAD(to_end);
2111
2112 fc->connected = 0;
2113 fc->blocked = 0;
2114 fc->aborted = is_abort;
2115 fuse_set_initialized(fc);
2116 list_for_each_entry(fud, &fc->devices, entry) {
2117 struct fuse_pqueue *fpq = &fud->pq;
2118
2119 spin_lock(&fpq->lock);
2120 fpq->connected = 0;
2121 list_for_each_entry_safe(req, next, &fpq->io, list) {
2122 req->out.h.error = -ECONNABORTED;
2123 spin_lock(&req->waitq.lock);
2124 set_bit(FR_ABORTED, &req->flags);
2125 if (!test_bit(FR_LOCKED, &req->flags)) {
2126 set_bit(FR_PRIVATE, &req->flags);
2127 __fuse_get_request(req);
2128 list_move(&req->list, &to_end);
2129 }
2130 spin_unlock(&req->waitq.lock);
2131 }
2132 list_splice_tail_init(&fpq->processing, &to_end);
2133 spin_unlock(&fpq->lock);
2134 }
2135 fc->max_background = UINT_MAX;
2136 flush_bg_queue(fc);
2137
2138 spin_lock(&fiq->waitq.lock);
2139 fiq->connected = 0;
2140 list_for_each_entry(req, &fiq->pending, list)
2141 clear_bit(FR_PENDING, &req->flags);
2142 list_splice_tail_init(&fiq->pending, &to_end);
2143 while (forget_pending(fiq))
2144 kfree(dequeue_forget(fiq, 1, NULL));
2145 wake_up_all_locked(&fiq->waitq);
2146 spin_unlock(&fiq->waitq.lock);
2147 kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
2148 end_polls(fc);
2149 wake_up_all(&fc->blocked_waitq);
2150 spin_unlock(&fc->lock);
2151
2152 end_requests(fc, &to_end);
2153 } else {
2154 spin_unlock(&fc->lock);
2155 }
2156 }
2157 EXPORT_SYMBOL_GPL(fuse_abort_conn);
2158
2159 void fuse_wait_aborted(struct fuse_conn *fc)
2160 {
2161 wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
2162 }
2163
2164 int fuse_dev_release(struct inode *inode, struct file *file)
2165 {
2166 struct fuse_dev *fud = fuse_get_dev(file);
2167
2168 if (fud) {
2169 struct fuse_conn *fc = fud->fc;
2170 struct fuse_pqueue *fpq = &fud->pq;
2171 LIST_HEAD(to_end);
2172
2173 spin_lock(&fpq->lock);
2174 WARN_ON(!list_empty(&fpq->io));
2175 list_splice_init(&fpq->processing, &to_end);
2176 spin_unlock(&fpq->lock);
2177
2178 end_requests(fc, &to_end);
2179
2180 /* Are we the last open device? */
2181 if (atomic_dec_and_test(&fc->dev_count)) {
2182 WARN_ON(fc->iq.fasync != NULL);
2183 fuse_abort_conn(fc, false);
2184 }
2185 fuse_dev_free(fud);
2186 }
2187 return 0;
2188 }
2189 EXPORT_SYMBOL_GPL(fuse_dev_release);
2190
2191 static int fuse_dev_fasync(int fd, struct file *file, int on)
2192 {
2193 struct fuse_dev *fud = fuse_get_dev(file);
2194
2195 if (!fud)
2196 return -EPERM;
2197
2198 /* No locking - fasync_helper does its own locking */
2199 return fasync_helper(fd, file, on, &fud->fc->iq.fasync);
2200 }
2201
2202 static int fuse_device_clone(struct fuse_conn *fc, struct file *new)
2203 {
2204 struct fuse_dev *fud;
2205
2206 if (new->private_data)
2207 return -EINVAL;
2208
2209 fud = fuse_dev_alloc(fc);
2210 if (!fud)
2211 return -ENOMEM;
2212
2213 new->private_data = fud;
2214 atomic_inc(&fc->dev_count);
2215
2216 return 0;
2217 }
2218
2219 static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
2220 unsigned long arg)
2221 {
2222 int err = -ENOTTY;
2223
2224 if (cmd == FUSE_DEV_IOC_CLONE) {
2225 int oldfd;
2226
2227 err = -EFAULT;
2228 if (!get_user(oldfd, (__u32 __user *) arg)) {
2229 struct file *old = fget(oldfd);
2230
2231 err = -EINVAL;
2232 if (old) {
2233 struct fuse_dev *fud = NULL;
2234
2235 /*
2236 * Check against file->f_op because CUSE
2237 * uses the same ioctl handler.
2238 */
2239 if (old->f_op == file->f_op &&
2240 old->f_cred->user_ns == file->f_cred->user_ns)
2241 fud = fuse_get_dev(old);
2242
2243 if (fud) {
2244 mutex_lock(&fuse_mutex);
2245 err = fuse_device_clone(fud->fc, file);
2246 mutex_unlock(&fuse_mutex);
2247 }
2248 fput(old);
2249 }
2250 }
2251 }
2252 return err;
2253 }
2254
2255 const struct file_operations fuse_dev_operations = {
2256 .owner = THIS_MODULE,
2257 .open = fuse_dev_open,
2258 .llseek = no_llseek,
2259 .read_iter = fuse_dev_read,
2260 .splice_read = fuse_dev_splice_read,
2261 .write_iter = fuse_dev_write,
2262 .splice_write = fuse_dev_splice_write,
2263 .poll = fuse_dev_poll,
2264 .release = fuse_dev_release,
2265 .fasync = fuse_dev_fasync,
2266 .unlocked_ioctl = fuse_dev_ioctl,
2267 .compat_ioctl = fuse_dev_ioctl,
2268 };
2269 EXPORT_SYMBOL_GPL(fuse_dev_operations);
2270
2271 static struct miscdevice fuse_miscdevice = {
2272 .minor = FUSE_MINOR,
2273 .name = "fuse",
2274 .fops = &fuse_dev_operations,
2275 };
2276
2277 int __init fuse_dev_init(void)
2278 {
2279 int err = -ENOMEM;
2280 fuse_req_cachep = kmem_cache_create("fuse_request",
2281 sizeof(struct fuse_req),
2282 0, 0, NULL);
2283 if (!fuse_req_cachep)
2284 goto out;
2285
2286 err = misc_register(&fuse_miscdevice);
2287 if (err)
2288 goto out_cache_clean;
2289
2290 return 0;
2291
2292 out_cache_clean:
2293 kmem_cache_destroy(fuse_req_cachep);
2294 out:
2295 return err;
2296 }
2297
2298 void fuse_dev_cleanup(void)
2299 {
2300 misc_deregister(&fuse_miscdevice);
2301 kmem_cache_destroy(fuse_req_cachep);
2302 }
Ubuntu Jammy Linux kernel mirror