3 files changed, 5 insertions, 3 deletions

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index a5e516a40e7a..809c0f2f9942 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.h.nodeid = outarg->nodeid;
         req->in.numargs = 2;
         req->in.argpages = 1;
-        req->page_descs[0].offset = offset;
         req->end = fuse_retrieve_end;
 
         index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
 
                 this_num = min_t(unsigned, num, PAGE_SIZE - offset);
                 req->pages[req->num_pages] = page;
+                req->page_descs[req->num_pages].offset = offset;
                 req->page_descs[req->num_pages].length = this_num;
                 req->num_pages++;
 
@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
 
         ret = fuse_dev_do_write(fud, &cs, len);
 
+        pipe_lock(pipe);
         for (idx = 0; idx < nbuf; idx++)
                 pipe_buf_release(pipe, &bufs[idx]);
+        pipe_unlock(pipe);
 
 out:
         kvfree(bufs);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index ffaffe18352a..a59c16bd90ac 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1782,7 +1782,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req,
                 spin_unlock(&fc->lock);
 
                 dec_wb_stat(&bdi->wb, WB_WRITEBACK);
-                dec_node_page_state(page, NR_WRITEBACK_TEMP);
+                dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
                 wb_writeout_inc(&bdi->wb);
                 fuse_writepage_free(fc, new_req);
                 fuse_request_free(new_req);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 76baaa6be393..c2d4099429be 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -628,6 +628,7 @@ void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns)
         get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
         fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
         fc->user_ns = get_user_ns(user_ns);
+        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 }
 EXPORT_SYMBOL_GPL(fuse_conn_init);
 
@@ -1162,7 +1163,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
         fc->max_read = max_t(unsigned, 4096, d.max_read);
-        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;