fuse: fix max i/o size calculation

Fix a bug that Werner Baumann reported: fuse can send a bigger write request
than the maximum specified.  This only affected direct_io operation.

In addition set a sane minimum for the max_read and max_write tunables, so I/O
always makes some progress.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 6 insertions, 4 deletions

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a02418c89d4b..2d3649e42599 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -966,14 +966,15 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
 
         while (count) {
                 size_t nres;
-                size_t nbytes = min(count, nmax);
-                int err = fuse_get_user_pages(req, buf, nbytes, !write);
+                size_t nbytes_limit = min(count, nmax);
+                size_t nbytes;
+                int err = fuse_get_user_pages(req, buf, nbytes_limit, !write);
                 if (err) {
                         res = err;
                         break;
                 }
                 nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
-                nbytes = min(count, nbytes);
+                nbytes = min(nbytes_limit, nbytes);
                 if (write)
                         nres = fuse_send_write(req, file, inode, pos, nbytes,
                                                current->files);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 7d01c68852a8..0cef5ea319f3 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -584,6 +584,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                 fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
                 fc->minor = arg->minor;
                 fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
+                fc->max_write = min_t(unsigned, 4096, fc->max_write);
                 fc->conn_init = 1;
         }
         fuse_put_request(fc, req);
@@ -658,7 +659,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->flags = d.flags;
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
-        fc->max_read = d.max_read;
+        fc->max_read = min_t(unsigned, 4096, d.max_read);
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;