diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2021-08-17 21:05:16 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-11-26 11:36:18 +0100 |
| commit | 515df9b954af92e1286354d2b8033e5a0b8ba374 (patch) | |
| tree | e9c42875c386aae18bdd40ce20e3e241d1a97e73 /fs | |
| parent | a5153fb8baa29202227a4f809eaec3c4203ebcf5 (diff) | |
| download | linux-stable-515df9b954af92e1286354d2b8033e5a0b8ba374.tar.gz linux-stable-515df9b954af92e1286354d2b8033e5a0b8ba374.tar.bz2 linux-stable-515df9b954af92e1286354d2b8033e5a0b8ba374.zip | |
fuse: truncate pagecache on atomic_o_trunc
commit 76224355db7570cbe6b6f75c8929a1558828dd55 upstream.
fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic
O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in
fuse_launder_page() triggered by invalidate_inode_pages2().
Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a
truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE
or fc->writeback cache, so do it unconditionally.
Reported-by: Xie Yongji <xieyongji@bytedance.com>
Reported-and-tested-by: syzbot+bea44a5189836d956894@syzkaller.appspotmail.com
Fixes: e4648309b85a ("fuse: truncate pending writes on O_TRUNC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/fuse/file.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 6a3d89672ff7..13371a40f7a1 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -178,12 +178,11 @@ void fuse_finish_open(struct inode *inode, struct file *file) if (ff->open_flags & FOPEN_DIRECT_IO) file->f_op = &fuse_direct_io_file_operations; - if (!(ff->open_flags & FOPEN_KEEP_CACHE)) - invalidate_inode_pages2(inode->i_mapping); if (ff->open_flags & FOPEN_STREAM) stream_open(inode, file); else if (ff->open_flags & FOPEN_NONSEEKABLE) nonseekable_open(inode, file); + if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) { struct fuse_inode *fi = get_fuse_inode(inode); @@ -191,10 +190,14 @@ void fuse_finish_open(struct inode *inode, struct file *file) fi->attr_version = ++fc->attr_version; i_size_write(inode, 0); spin_unlock(&fc->lock); + truncate_pagecache(inode, 0); fuse_invalidate_attr(inode); if (fc->writeback_cache) file_update_time(file); + } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) { + invalidate_inode_pages2(inode->i_mapping); } + if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache) fuse_link_write_file(file); } |