3 files changed, 47 insertions, 40 deletions

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index cc750c68fe70..104a62dadb94 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -128,14 +128,24 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
         }
 }
 
-void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req)
+/*
+ * Called with sbput_sem held for read (request_end) or write
+ * (fuse_put_super).  By the time fuse_put_super() is finished, all
+ * inodes belonging to background requests must be released, so the
+ * iputs have to be done within the locked region.
+ */
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)
 {
-        list_del_init(&req->bg_entry);
+        iput(req->inode);
+        iput(req->inode2);
+        spin_lock(&fc->lock);
+        list_del(&req->bg_entry);
         if (fc->num_background == FUSE_MAX_BACKGROUND) {
                 fc->blocked = 0;
                 wake_up_all(&fc->blocked_waitq);
         }
         fc->num_background--;
+        spin_unlock(&fc->lock);
 }
 
 /*
@@ -165,27 +175,22 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                 wake_up(&req->waitq);
                 fuse_put_request(fc, req);
         } else {
-                struct inode *inode = req->inode;
-                struct inode *inode2 = req->inode2;
-                struct file *file = req->file;
                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
                 req->end = NULL;
-                req->inode = NULL;
-                req->inode2 = NULL;
-                req->file = NULL;
-                if (!list_empty(&req->bg_entry))
-                        fuse_remove_background(fc, req);
                 spin_unlock(&fc->lock);
+                down_read(&fc->sbput_sem);
+                if (fc->mounted)
+                        fuse_release_background(fc, req);
+                up_read(&fc->sbput_sem);
+
+                /* fput must go outside sbput_sem, otherwise it can deadlock */
+                if (req->file)
+                        fput(req->file);
 
                 if (end)
                         end(fc, req);
                 else
                         fuse_put_request(fc, req);
-
-                if (file)
-                        fput(file);
-                iput(inode);
-                iput(inode2);
         }
 }
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 59661c481d9d..0474202cb5dc 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -258,9 +258,15 @@ struct fuse_conn {
         /** waitq for blocked connection */
         wait_queue_head_t blocked_waitq;
 
+        /** RW semaphore for exclusion with fuse_put_super() */
+        struct rw_semaphore sbput_sem;
+
         /** The next unique request id */
         u64 reqctr;
 
+        /** Mount is active */
+        unsigned mounted;
+
         /** Connection established, cleared on umount, connection
             abort and device release */
         unsigned connected;
@@ -471,11 +477,11 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req);
 void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
 
 /**
- * Remove request from the the background list
+ * Release inodes and file associated with background request
  */
-void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req);
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);
 
-/** Abort all requests */
+/* Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
 
 /**
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 43a6fc0db8a7..7627022446b2 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -204,26 +204,17 @@ static void fuse_put_super(struct super_block *sb)
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
 
+        down_write(&fc->sbput_sem);
+        while (!list_empty(&fc->background))
+                fuse_release_background(fc,
+                                        list_entry(fc->background.next,
+                                                   struct fuse_req, bg_entry));
+
         spin_lock(&fc->lock);
+        fc->mounted = 0;
         fc->connected = 0;
-        while (!list_empty(&fc->background)) {
-                struct fuse_req *req = list_entry(fc->background.next,
-                                                  struct fuse_req, bg_entry);
-                struct inode *inode = req->inode;
-                struct inode *inode2 = req->inode2;
-
-                /* File would hold a reference to vfsmount */
-                BUG_ON(req->file);
-                req->inode = NULL;
-                req->inode2 = NULL;
-                fuse_remove_background(fc, req);
-
-                spin_unlock(&fc->lock);
-                iput(inode);
-                iput(inode2);
-                spin_lock(&fc->lock);
-        }
         spin_unlock(&fc->lock);
+        up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
         wake_up_all(&fc->waitq);
@@ -395,6 +386,7 @@ static struct fuse_conn *new_conn(void)
                 INIT_LIST_HEAD(&fc->processing);
                 INIT_LIST_HEAD(&fc->io);
                 INIT_LIST_HEAD(&fc->background);
+                init_rwsem(&fc->sbput_sem);
                 kobj_set_kset_s(fc, connections_subsys);
                 kobject_init(&fc->kobj);
                 atomic_set(&fc->num_waiting, 0);
@@ -508,11 +500,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (file->f_op != &fuse_dev_operations)
                 return -EINVAL;
 
-        /* Setting file->private_data can't race with other mount()
-           instances, since BKL is held for ->get_sb() */
-        if (file->private_data)
-                return -EINVAL;
-
         fc = new_conn();
         if (!fc)
                 return -ENOMEM;
@@ -548,7 +535,14 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (err)
                 goto err_free_req;
 
+        /* Setting file->private_data can't race with other mount()
+           instances, since BKL is held for ->get_sb() */
+        err = -EINVAL;
+        if (file->private_data)
+                goto err_kobject_del;
+
         sb->s_root = root_dentry;
+        fc->mounted = 1;
         fc->connected = 1;
         kobject_get(&fc->kobj);
         file->private_data = fc;
@@ -563,6 +557,8 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 
         return 0;
 
+ err_kobject_del:
+        kobject_del(&fc->kobj);
  err_free_req:
         fuse_request_free(init_req);
  err_put_root: