[PATCH] fuse: fix hang on SMP

Fuse didn't always call i_size_write() with i_mutex held which caused rare
hangs on SMP/32bit.  This bug has been present since fuse-2.2, well before
being merged into mainline.

The simplest solution is to protect i_size_write() with the per-connection
spinlock.  Using i_mutex for this purpose would require some restructuring of
the code and I'm not even sure it's always safe to acquire i_mutex in all
places i_size needs to be set.

Since most of vmtruncate is already duplicated for other reasons, duplicate
the remaining part as well, making all i_size_write() calls internal to fuse.

Using i_size_write() was unnecessary in fuse_init_inode(), since this function
is only called on a newly created locked inode.

Reported by a few people over the years, but special thanks to Dana Henriksen
who was persistent enough in helping me debug it.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 21 insertions, 9 deletions

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8605155db171..a8f65c11aa2c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -935,14 +935,30 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg)
         }
 }
 
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        int need_trunc;
+
+        spin_lock(&fc->lock);
+        need_trunc = inode->i_size > offset;
+        i_size_write(inode, offset);
+        spin_unlock(&fc->lock);
+
+        if (need_trunc) {
+                struct address_space *mapping = inode->i_mapping;
+                unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+                truncate_inode_pages(mapping, offset);
+        }
+}
+
 /*
  * Set attributes, and at the same time refresh them.
  *
  * Truncation is slightly complicated, because the 'truncate' request
  * may fail, in which case we don't want to touch the mapping.
- * vmtruncate() doesn't allow for this case.  So do the rlimit
- * checking by hand and call vmtruncate() only after the file has
- * actually been truncated.
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
  */
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)
 {
@@ -993,12 +1009,8 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                         make_bad_inode(inode);
                         err = -EIO;
                 } else {
-                        if (is_truncate) {
-                                loff_t origsize = i_size_read(inode);
-                                i_size_write(inode, outarg.attr.size);
-                                if (origsize > outarg.attr.size)
-                                        vmtruncate(inode, outarg.attr.size);
-                        }
+                        if (is_truncate)
+                                fuse_vmtruncate(inode, outarg.attr.size);
                         fuse_change_attributes(inode, &outarg.attr);
                         fi->i_time = time_to_jiffies(outarg.attr_valid,
                                                      outarg.attr_valid_nsec);