[PATCH] fuse: account background requests

The previous patch removed limiting the number of outstanding requests.  This
patch adds a much simpler limiting, that is also compatible with file locking
operations.

A task may have at most one synchronous request allocated.  So these requests
need not be otherwise limited.

However the number of background requests (release, forget, asynchronous
reads, interrupted requests) can grow indefinitely.  This can be used by a
malicous user to cause FUSE to allocate arbitrary amounts of unswappable
kernel memory, denying service.

For this reason add a limit for the number of background requests, and block
allocations of new requests until the number goes bellow the limit.

Also use this mechanism to block all requests until the INIT reply is
received.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 4 insertions, 0 deletions

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 824ebbc428ed..fd34037b0588 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -381,6 +381,7 @@ static struct fuse_conn *new_conn(void)
         if (fc) {
                 spin_lock_init(&fc->lock);
                 init_waitqueue_head(&fc->waitq);
+                init_waitqueue_head(&fc->blocked_waitq);
                 INIT_LIST_HEAD(&fc->pending);
                 INIT_LIST_HEAD(&fc->processing);
                 INIT_LIST_HEAD(&fc->io);
@@ -392,6 +393,7 @@ static struct fuse_conn *new_conn(void)
                 fc->bdi.ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE;
                 fc->bdi.unplug_io_fn = default_unplug_io_fn;
                 fc->reqctr = 0;
+                fc->blocked = 1;
         }
         return fc;
 }
@@ -438,6 +440,8 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                 fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
         }
         fuse_put_request(fc, req);
+        fc->blocked = 0;
+        wake_up_all(&fc->blocked_waitq);
 }
 
 static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)