fuse: umount should wait for all requests

BugLink: https://bugs.launchpad.net/bugs/1824553
fuse_abort_conn() does not guarantee that all async requests have actually
finished aborting (i.e. their ->end() function is called).  This could
actually result in still used inodes after umount.

Add a helper to wait until all requests are fully done.  This is done by
looking at the "num_waiting" counter.  When this counter drops to zero, we
can be sure that no more requests are outstanding.

Fixes: 0d8e84b0432b ("fuse: simplify request abort")
Cc: <stable@vger.kernel.org> # v4.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
(backported from commit b8f95e5d13f5f0191dcb4b9113113d241636e7cb)
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index b28cbc0532ce082dcd1e76b0de248c362afc60b2..b1c3dd2eda01dade1a1475b08a4b1c63881eecb6 100644 (file)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -131,6 +131,16 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
        return !fc->initialized || (for_background && fc->blocked);
 }
 
+static void fuse_drop_waiting(struct fuse_conn *fc)
+{
+       if (fc->connected) {
+               atomic_dec(&fc->num_waiting);
+       } else if (atomic_dec_and_test(&fc->num_waiting)) {
+               /* wake up aborters */
+               wake_up_all(&fc->blocked_waitq);
+       }
+}
+
 static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
                                       bool for_background)
 {
@@ -175,7 +185,7 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
        return req;
 
  out:
-       atomic_dec(&fc->num_waiting);
+       fuse_drop_waiting(fc);
        return ERR_PTR(err);
 }
 
@@ -282,7 +292,7 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 
                if (test_bit(FR_WAITING, &req->flags)) {
                        __clear_bit(FR_WAITING, &req->flags);
-                       atomic_dec(&fc->num_waiting);
+                       fuse_drop_waiting(fc);
                }
 
                if (req->stolen_file)
@@ -368,7 +378,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
        struct fuse_iqueue *fiq = &fc->iq;
 
        if (test_and_set_bit(FR_FINISHED, &req->flags))
-               goto out_put_req;
+               goto put_request;
 
        spin_lock(&fiq->waitq.lock);
        list_del_init(&req->intr_entry);
@@ -397,7 +407,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
        wake_up(&req->waitq);
        if (req->end)
                req->end(fc, req);
-out_put_req:
+put_request:
        fuse_put_request(fc, req);
 }
 
@@ -2148,6 +2158,11 @@ void fuse_abort_conn(struct fuse_conn *fc)
 }
 EXPORT_SYMBOL_GPL(fuse_abort_conn);
 
+void fuse_wait_aborted(struct fuse_conn *fc)
+{
+       wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
+}
+
 int fuse_dev_release(struct inode *inode, struct file *file)
 {
        struct fuse_dev *fud = fuse_get_dev(file);

diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 8a15e90d2329475508f962947efafe527cc82de3..a6a33272c15328f257fa563a94fbdcfb2a3775ff 100644 (file)
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -856,6 +856,7 @@ void fuse_request_send_background_locked(struct fuse_conn *fc,
 
 /* Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
+void fuse_wait_aborted(struct fuse_conn *fc);
 
 /**
  * Invalidate inode attributes

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 9e1ddf5c1797393e2697953f12370155d70403a9..30c7e46745ca9a74f21748253614594b79b6c453 100644 (file)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -400,6 +400,8 @@ static void fuse_put_super(struct super_block *sb)
        fuse_send_destroy(fc);
 
        fuse_abort_conn(fc);
+       fuse_wait_aborted(fc);
+
        mutex_lock(&fuse_mutex);
        list_del(&fc->entry);
        fuse_ctl_remove_conn(fc);