4 files changed, 134 insertions, 64 deletions

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8605155db1..c71a6c092a 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -138,6 +138,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 struct fuse_entry_out outarg;
                 struct fuse_conn *fc;
                 struct fuse_req *req;
+                struct fuse_req *forget_req;
+                struct dentry *parent;
 
                 /* Doesn't hurt to "reset" the validity timeout */
                 fuse_invalidate_entry_cache(entry);
@@ -151,21 +153,33 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (IS_ERR(req))
                         return 0;
 
-                fuse_lookup_init(req, entry->d_parent->d_inode, entry, &outarg);
+                forget_req = fuse_get_req(fc);
+                if (IS_ERR(forget_req)) {
+                        fuse_put_request(fc, req);
+                        return 0;
+                }
+
+                parent = dget_parent(entry);
+                fuse_lookup_init(req, parent->d_inode, entry, &outarg);
                 request_send(fc, req);
+                dput(parent);
                 err = req->out.h.error;
+                fuse_put_request(fc, req);
                 /* Zero nodeid is same as -ENOENT */
                 if (!err && !outarg.nodeid)
                         err = -ENOENT;
                 if (!err) {
                         struct fuse_inode *fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
-                                fuse_send_forget(fc, req, outarg.nodeid, 1);
+                                fuse_send_forget(fc, forget_req,
+                                                 outarg.nodeid, 1);
                                 return 0;
                         }
+                        spin_lock(&fc->lock);
                         fi->nlookup ++;
+                        spin_unlock(&fc->lock);
                 }
-                fuse_put_request(fc, req);
+                fuse_put_request(fc, forget_req);
                 if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
                         return 0;
 
@@ -175,22 +189,6 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
         return 1;
 }
 
-/*
- * Check if there's already a hashed alias of this directory inode.
- * If yes, then lookup and mkdir must not create a new alias.
- */
-static int dir_alias(struct inode *inode)
-{
-        if (S_ISDIR(inode->i_mode)) {
-                struct dentry *alias = d_find_alias(inode);
-                if (alias) {
-                        dput(alias);
-                        return 1;
-                }
-        }
-        return 0;
-}
-
 static int invalid_nodeid(u64 nodeid)
 {
         return !nodeid || nodeid == FUSE_ROOT_ID;
@@ -206,6 +204,24 @@ static int valid_mode(int m)
                 S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
 }
 
+/*
+ * Add a directory inode to a dentry, ensuring that no other dentry
+ * refers to this inode.  Called with fc->inst_mutex.
+ */
+static int fuse_d_add_directory(struct dentry *entry, struct inode *inode)
+{
+        struct dentry *alias = d_find_alias(inode);
+        if (alias) {
+                /* This tries to shrink the subtree below alias */
+                fuse_invalidate_entry(alias);
+                dput(alias);
+                if (!list_empty(&inode->i_dentry))
+                        return -EBUSY;
+        }
+        d_add(entry, inode);
+        return 0;
+}
+
 static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
                                   struct nameidata *nd)
 {
@@ -214,6 +230,7 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         struct inode *inode = NULL;
         struct fuse_conn *fc = get_fuse_conn(dir);
         struct fuse_req *req;
+        struct fuse_req *forget_req;
 
         if (entry->d_name.len > FUSE_NAME_MAX)
                 return ERR_PTR(-ENAMETOOLONG);
@@ -222,9 +239,16 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         if (IS_ERR(req))
                 return ERR_PTR(PTR_ERR(req));
 
+        forget_req = fuse_get_req(fc);
+        if (IS_ERR(forget_req)) {
+                fuse_put_request(fc, req);
+                return ERR_PTR(PTR_ERR(forget_req));
+        }
+
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
+        fuse_put_request(fc, req);
         /* Zero nodeid is same as -ENOENT, but with valid timeout */
         if (!err && outarg.nodeid &&
             (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
@@ -233,19 +257,25 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                                   &outarg.attr);
                 if (!inode) {
-                        fuse_send_forget(fc, req, outarg.nodeid, 1);
+                        fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
                         return ERR_PTR(-ENOMEM);
                 }
         }
-        fuse_put_request(fc, req);
+        fuse_put_request(fc, forget_req);
         if (err && err != -ENOENT)
                 return ERR_PTR(err);
 
-        if (inode && dir_alias(inode)) {
-                iput(inode);
-                return ERR_PTR(-EIO);
-        }
-        d_add(entry, inode);
+        if (inode && S_ISDIR(inode->i_mode)) {
+                mutex_lock(&fc->inst_mutex);
+                err = fuse_d_add_directory(entry, inode);
+                mutex_unlock(&fc->inst_mutex);
+                if (err) {
+                        iput(inode);
+                        return ERR_PTR(err);
+                }
+        } else
+                d_add(entry, inode);
+
         entry->d_op = &fuse_dentry_operations;
         if (!err)
                 fuse_change_timeout(entry, &outarg);
@@ -375,6 +405,13 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         struct fuse_entry_out outarg;
         struct inode *inode;
         int err;
+        struct fuse_req *forget_req;
+
+        forget_req = fuse_get_req(fc);
+        if (IS_ERR(forget_req)) {
+                fuse_put_request(fc, req);
+                return PTR_ERR(forget_req);
+        }
 
         req->in.h.nodeid = get_node_id(dir);
         req->out.numargs = 1;
@@ -382,37 +419,47 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         req->out.args[0].value = &outarg;
         request_send(fc, req);
         err = req->out.h.error;
-        if (err) {
-                fuse_put_request(fc, req);
-                return err;
-        }
+        fuse_put_request(fc, req);
+        if (err)
+                goto out_put_forget_req;
+
         err = -EIO;
         if (invalid_nodeid(outarg.nodeid))
-                goto out_put_request;
+                goto out_put_forget_req;
 
         if ((outarg.attr.mode ^ mode) & S_IFMT)
-                goto out_put_request;
+                goto out_put_forget_req;
 
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr);
         if (!inode) {
-                fuse_send_forget(fc, req, outarg.nodeid, 1);
+                fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
                 return -ENOMEM;
         }
-        fuse_put_request(fc, req);
+        fuse_put_request(fc, forget_req);
 
-        if (dir_alias(inode)) {
-                iput(inode);
-                return -EIO;
-        }
+        if (S_ISDIR(inode->i_mode)) {
+                struct dentry *alias;
+                mutex_lock(&fc->inst_mutex);
+                alias = d_find_alias(inode);
+                if (alias) {
+                        /* New directory must have moved since mkdir */
+                        mutex_unlock(&fc->inst_mutex);
+                        dput(alias);
+                        iput(inode);
+                        return -EBUSY;
+                }
+                d_instantiate(entry, inode);
+                mutex_unlock(&fc->inst_mutex);
+        } else
+                d_instantiate(entry, inode);
 
-        d_instantiate(entry, inode);
         fuse_change_timeout(entry, &outarg);
         fuse_invalidate_attr(dir);
         return 0;
 
- out_put_request:
-        fuse_put_request(fc, req);
+ out_put_forget_req:
+        fuse_put_request(fc, forget_req);
         return err;
 }
 
@@ -935,14 +982,30 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg)
         }
 }
 
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        int need_trunc;
+
+        spin_lock(&fc->lock);
+        need_trunc = inode->i_size > offset;
+        i_size_write(inode, offset);
+        spin_unlock(&fc->lock);
+
+        if (need_trunc) {
+                struct address_space *mapping = inode->i_mapping;
+                unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+                truncate_inode_pages(mapping, offset);
+        }
+}
+
 /*
  * Set attributes, and at the same time refresh them.
  *
  * Truncation is slightly complicated, because the 'truncate' request
  * may fail, in which case we don't want to touch the mapping.
- * vmtruncate() doesn't allow for this case.  So do the rlimit
- * checking by hand and call vmtruncate() only after the file has
- * actually been truncated.
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
  */
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)
 {
@@ -993,12 +1056,8 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                         make_bad_inode(inode);
                         err = -EIO;
                 } else {
-                        if (is_truncate) {
-                                loff_t origsize = i_size_read(inode);
-                                i_size_write(inode, outarg.attr.size);
-                                if (origsize > outarg.attr.size)
-                                        vmtruncate(inode, outarg.attr.size);
-                        }
+                        if (is_truncate)
+                                fuse_vmtruncate(inode, outarg.attr.size);
                         fuse_change_attributes(inode, &outarg.attr);
                         fi->i_time = time_to_jiffies(outarg.attr_valid,
                                                      outarg.attr_valid_nsec);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 183626868e..763a50daf1 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -397,14 +397,14 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         err = -EIO;
         if (is_bad_inode(inode))
-                goto clean_pages_up;
+                goto out;
 
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
         err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
-                goto clean_pages_up;
+                goto out;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
@@ -413,10 +413,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 else
                         fuse_put_request(fc, data.req);
         }
-        return err;
-
-clean_pages_up:
-        put_pages_list(pages);
+out:
         return err;
 }
 
@@ -481,8 +478,10 @@ static int fuse_commit_write(struct file *file, struct page *page,
                 err = -EIO;
         if (!err) {
                 pos += count;
-                if (pos > i_size_read(inode))
+                spin_lock(&fc->lock);
+                if (pos > inode->i_size)
                         i_size_write(inode, pos);
+                spin_unlock(&fc->lock);
 
                 if (offset == 0 && to == PAGE_CACHE_SIZE) {
                         clear_page_dirty(page);
@@ -586,8 +585,12 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
         }
         fuse_put_request(fc, req);
         if (res > 0) {
-                if (write && pos > i_size_read(inode))
-                        i_size_write(inode, pos);
+                if (write) {
+                        spin_lock(&fc->lock);
+                        if (pos > inode->i_size)
+                                i_size_write(inode, pos);
+                        spin_unlock(&fc->lock);
+                }
                 *ppos = pos;
         }
         fuse_invalidate_attr(inode);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 69c7750d55..91edb8932d 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -239,6 +239,9 @@ struct fuse_conn {
         /** Lock protecting accessess to  members of this structure */
         spinlock_t lock;
 
+        /** Mutex protecting against directory alias creation */
+        struct mutex inst_mutex;
+
         /** Refcount */
         atomic_t count;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 7d0a9aee01..fc42035703 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
 
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
 {
+        struct fuse_conn *fc = get_fuse_conn(inode);
         if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size)
                 invalidate_inode_pages(inode->i_mapping);
 
@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
         inode->i_nlink   = attr->nlink;
         inode->i_uid     = attr->uid;
         inode->i_gid     = attr->gid;
+        spin_lock(&fc->lock);
         i_size_write(inode, attr->size);
+        spin_unlock(&fc->lock);
         inode->i_blocks  = attr->blocks;
         inode->i_atime.tv_sec   = attr->atime;
         inode->i_atime.tv_nsec  = attr->atimensec;
@@ -130,7 +133,7 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
 static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
 {
         inode->i_mode = attr->mode & S_IFMT;
-        i_size_write(inode, attr->size);
+        inode->i_size = attr->size;
         if (S_ISREG(inode->i_mode)) {
                 fuse_init_common(inode);
                 fuse_init_file_inode(inode);
@@ -169,7 +172,6 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
         struct inode *inode;
         struct fuse_inode *fi;
         struct fuse_conn *fc = get_fuse_conn_super(sb);
-        int retried = 0;
 
  retry:
         inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set, &nodeid);
@@ -183,16 +185,16 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
                 fuse_init_inode(inode, attr);
                 unlock_new_inode(inode);
         } else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
-                BUG_ON(retried);
                 /* Inode has changed type, any I/O on the old should fail */
                 make_bad_inode(inode);
                 iput(inode);
-                retried = 1;
                 goto retry;
         }
 
         fi = get_fuse_inode(inode);
+        spin_lock(&fc->lock);
         fi->nlookup ++;
+        spin_unlock(&fc->lock);
         fuse_change_attributes(inode, attr);
         return inode;
 }
@@ -377,6 +379,7 @@ static struct fuse_conn *new_conn(void)
         fc = kzalloc(sizeof(*fc), GFP_KERNEL);
         if (fc) {
                 spin_lock_init(&fc->lock);
+                mutex_init(&fc->inst_mutex);
                 atomic_set(&fc->count, 1);
                 init_waitqueue_head(&fc->waitq);
                 init_waitqueue_head(&fc->blocked_waitq);
@@ -396,8 +399,10 @@ static struct fuse_conn *new_conn(void)
 
 void fuse_conn_put(struct fuse_conn *fc)
 {
-        if (atomic_dec_and_test(&fc->count))
+        if (atomic_dec_and_test(&fc->count)) {
+                mutex_destroy(&fc->inst_mutex);
                 kfree(fc);
+        }
 }
 
 struct fuse_conn *fuse_conn_get(struct fuse_conn *fc)