1 files changed, 81 insertions, 3 deletions

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index c4807b3fc8a3..48b9971ecd97 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1107,6 +1107,50 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg)
 }
 
 /*
+ * Prevent concurrent writepages on inode
+ *
+ * This is done by adding a negative bias to the inode write counter
+ * and waiting for all pending writes to finish.
+ */
+void fuse_set_nowrite(struct inode *inode)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        struct fuse_inode *fi = get_fuse_inode(inode);
+
+        BUG_ON(!mutex_is_locked(&inode->i_mutex));
+
+        spin_lock(&fc->lock);
+        BUG_ON(fi->writectr < 0);
+        fi->writectr += FUSE_NOWRITE;
+        spin_unlock(&fc->lock);
+        wait_event(fi->page_waitq, fi->writectr == FUSE_NOWRITE);
+}
+
+/*
+ * Allow writepages on inode
+ *
+ * Remove the bias from the writecounter and send any queued
+ * writepages.
+ */
+static void __fuse_release_nowrite(struct inode *inode)
+{
+        struct fuse_inode *fi = get_fuse_inode(inode);
+
+        BUG_ON(fi->writectr != FUSE_NOWRITE);
+        fi->writectr = 0;
+        fuse_flush_writepages(inode);
+}
+
+void fuse_release_nowrite(struct inode *inode)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+
+        spin_lock(&fc->lock);
+        __fuse_release_nowrite(inode);
+        spin_unlock(&fc->lock);
+}
+
+/*
  * Set attributes, and at the same time refresh them.
  *
  * Truncation is slightly complicated, because the 'truncate' request
@@ -1122,6 +1166,8 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
         struct fuse_req *req;
         struct fuse_setattr_in inarg;
         struct fuse_attr_out outarg;
+        bool is_truncate = false;
+        loff_t oldsize;
         int err;
 
         if (!fuse_allow_task(fc, current))
@@ -1145,12 +1191,16 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
                         send_sig(SIGXFSZ, current, 0);
                         return -EFBIG;
                 }
+                is_truncate = true;
         }
 
         req = fuse_get_req(fc);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
+        if (is_truncate)
+                fuse_set_nowrite(inode);
+
         memset(&inarg, 0, sizeof(inarg));
         memset(&outarg, 0, sizeof(outarg));
         iattr_to_fattr(attr, &inarg);
@@ -1181,16 +1231,44 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
         if (err) {
                 if (err == -EINTR)
                         fuse_invalidate_attr(inode);
-                return err;
+                goto error;
         }
 
         if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
                 make_bad_inode(inode);
-                return -EIO;
+                err = -EIO;
+                goto error;
+        }
+
+        spin_lock(&fc->lock);
+        fuse_change_attributes_common(inode, &outarg.attr,
+                                      attr_timeout(&outarg));
+        oldsize = inode->i_size;
+        i_size_write(inode, outarg.attr.size);
+
+        if (is_truncate) {
+                /* NOTE: this may release/reacquire fc->lock */
+                __fuse_release_nowrite(inode);
+        }
+        spin_unlock(&fc->lock);
+
+        /*
+         * Only call invalidate_inode_pages2() after removing
+         * FUSE_NOWRITE, otherwise fuse_launder_page() would deadlock.
+         */
+        if (S_ISREG(inode->i_mode) && oldsize != outarg.attr.size) {
+                if (outarg.attr.size < oldsize)
+                        fuse_truncate(inode->i_mapping, outarg.attr.size);
+                invalidate_inode_pages2(inode->i_mapping);
         }
 
-        fuse_change_attributes(inode, &outarg.attr, attr_timeout(&outarg), 0);
         return 0;
+
+error:
+        if (is_truncate)
+                fuse_release_nowrite(inode);
+
+        return err;
 }
 
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)