1 /* 2 FUSE: Filesystem in Userspace 3 Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu> 4 5 This program can be distributed under the terms of the GNU GPL. 6 See the file COPYING. 7 */ 8 9 #include "fuse_i.h" 10 11 #include <linux/init.h> 12 #include <linux/module.h> 13 #include <linux/poll.h> 14 #include <linux/uio.h> 15 #include <linux/miscdevice.h> 16 #include <linux/pagemap.h> 17 #include <linux/file.h> 18 #include <linux/slab.h> 19 #include <linux/pipe_fs_i.h> 20 #include <linux/swap.h> 21 #include <linux/splice.h> 22 #include <linux/aio.h> 23 24 MODULE_ALIAS_MISCDEV(FUSE_MINOR); 25 MODULE_ALIAS("devname:fuse"); 26 27 static struct kmem_cache *fuse_req_cachep; 28 29 static struct fuse_conn *fuse_get_conn(struct file *file) 30 { 31 /* 32 * Lockless access is OK, because file->private data is set 33 * once during mount and is valid until the file is released. 34 */ 35 return file->private_data; 36 } 37 38 static void fuse_request_init(struct fuse_req *req, struct page **pages, 39 struct fuse_page_desc *page_descs, 40 unsigned npages) 41 { 42 memset(req, 0, sizeof(*req)); 43 memset(pages, 0, sizeof(*pages) * npages); 44 memset(page_descs, 0, sizeof(*page_descs) * npages); 45 INIT_LIST_HEAD(&req->list); 46 INIT_LIST_HEAD(&req->intr_entry); 47 init_waitqueue_head(&req->waitq); 48 atomic_set(&req->count, 1); 49 req->pages = pages; 50 req->page_descs = page_descs; 51 req->max_pages = npages; 52 } 53 54 static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags) 55 { 56 struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags); 57 if (req) { 58 struct page **pages; 59 struct fuse_page_desc *page_descs; 60 61 if (npages <= FUSE_REQ_INLINE_PAGES) { 62 pages = req->inline_pages; 63 page_descs = req->inline_page_descs; 64 } else { 65 pages = kmalloc(sizeof(struct page *) * npages, flags); 66 page_descs = kmalloc(sizeof(struct fuse_page_desc) * 67 npages, flags); 68 } 69 70 if (!pages || !page_descs) { 71 kfree(pages); 72 kfree(page_descs); 73 kmem_cache_free(fuse_req_cachep, req); 74 return NULL; 75 } 76 77 fuse_request_init(req, pages, page_descs, npages); 78 } 79 return req; 80 } 81 82 struct fuse_req *fuse_request_alloc(unsigned npages) 83 { 84 return __fuse_request_alloc(npages, GFP_KERNEL); 85 } 86 EXPORT_SYMBOL_GPL(fuse_request_alloc); 87 88 struct fuse_req *fuse_request_alloc_nofs(unsigned npages) 89 { 90 return __fuse_request_alloc(npages, GFP_NOFS); 91 } 92 93 void fuse_request_free(struct fuse_req *req) 94 { 95 if (req->pages != req->inline_pages) { 96 kfree(req->pages); 97 kfree(req->page_descs); 98 } 99 kmem_cache_free(fuse_req_cachep, req); 100 } 101 102 static void block_sigs(sigset_t *oldset) 103 { 104 sigset_t mask; 105 106 siginitsetinv(&mask, sigmask(SIGKILL)); 107 sigprocmask(SIG_BLOCK, &mask, oldset); 108 } 109 110 static void restore_sigs(sigset_t *oldset) 111 { 112 sigprocmask(SIG_SETMASK, oldset, NULL); 113 } 114 115 void __fuse_get_request(struct fuse_req *req) 116 { 117 atomic_inc(&req->count); 118 } 119 120 /* Must be called with > 1 refcount */ 121 static void __fuse_put_request(struct fuse_req *req) 122 { 123 BUG_ON(atomic_read(&req->count) < 2); 124 atomic_dec(&req->count); 125 } 126 127 static void fuse_req_init_context(struct fuse_req *req) 128 { 129 req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid()); 130 req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid()); 131 req->in.h.pid = current->pid; 132 } 133 134 void fuse_set_initialized(struct fuse_conn *fc) 135 { 136 /* Make sure stores before this are seen on another CPU */ 137 smp_wmb(); 138 fc->initialized = 1; 139 } 140 141 static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background) 142 { 143 return !fc->initialized || (for_background && fc->blocked); 144 } 145 146 static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages, 147 bool for_background) 148 { 149 struct fuse_req *req; 150 int err; 151 atomic_inc(&fc->num_waiting); 152 153 if (fuse_block_alloc(fc, for_background)) { 154 sigset_t oldset; 155 int intr; 156 157 block_sigs(&oldset); 158 intr = wait_event_interruptible_exclusive(fc->blocked_waitq, 159 !fuse_block_alloc(fc, for_background)); 160 restore_sigs(&oldset); 161 err = -EINTR; 162 if (intr) 163 goto out; 164 } 165 /* Matches smp_wmb() in fuse_set_initialized() */ 166 smp_rmb(); 167 168 err = -ENOTCONN; 169 if (!fc->connected) 170 goto out; 171 172 req = fuse_request_alloc(npages); 173 err = -ENOMEM; 174 if (!req) { 175 if (for_background) 176 wake_up(&fc->blocked_waitq); 177 goto out; 178 } 179 180 fuse_req_init_context(req); 181 req->waiting = 1; 182 req->background = for_background; 183 return req; 184 185 out: 186 atomic_dec(&fc->num_waiting); 187 return ERR_PTR(err); 188 } 189 190 struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages) 191 { 192 return __fuse_get_req(fc, npages, false); 193 } 194 EXPORT_SYMBOL_GPL(fuse_get_req); 195 196 struct fuse_req *fuse_get_req_for_background(struct fuse_conn *fc, 197 unsigned npages) 198 { 199 return __fuse_get_req(fc, npages, true); 200 } 201 EXPORT_SYMBOL_GPL(fuse_get_req_for_background); 202 203 /* 204 * Return request in fuse_file->reserved_req. However that may 205 * currently be in use. If that is the case, wait for it to become 206 * available. 207 */ 208 static struct fuse_req *get_reserved_req(struct fuse_conn *fc, 209 struct file *file) 210 { 211 struct fuse_req *req = NULL; 212 struct fuse_file *ff = file->private_data; 213 214 do { 215 wait_event(fc->reserved_req_waitq, ff->reserved_req); 216 spin_lock(&fc->lock); 217 if (ff->reserved_req) { 218 req = ff->reserved_req; 219 ff->reserved_req = NULL; 220 req->stolen_file = get_file(file); 221 } 222 spin_unlock(&fc->lock); 223 } while (!req); 224 225 return req; 226 } 227 228 /* 229 * Put stolen request back into fuse_file->reserved_req 230 */ 231 static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req) 232 { 233 struct file *file = req->stolen_file; 234 struct fuse_file *ff = file->private_data; 235 236 spin_lock(&fc->lock); 237 fuse_request_init(req, req->pages, req->page_descs, req->max_pages); 238 BUG_ON(ff->reserved_req); 239 ff->reserved_req = req; 240 wake_up_all(&fc->reserved_req_waitq); 241 spin_unlock(&fc->lock); 242 fput(file); 243 } 244 245 /* 246 * Gets a requests for a file operation, always succeeds 247 * 248 * This is used for sending the FLUSH request, which must get to 249 * userspace, due to POSIX locks which may need to be unlocked. 250 * 251 * If allocation fails due to OOM, use the reserved request in 252 * fuse_file. 253 * 254 * This is very unlikely to deadlock accidentally, since the 255 * filesystem should not have it's own file open. If deadlock is 256 * intentional, it can still be broken by "aborting" the filesystem. 257 */ 258 struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc, 259 struct file *file) 260 { 261 struct fuse_req *req; 262 263 atomic_inc(&fc->num_waiting); 264 wait_event(fc->blocked_waitq, fc->initialized); 265 /* Matches smp_wmb() in fuse_set_initialized() */ 266 smp_rmb(); 267 req = fuse_request_alloc(0); 268 if (!req) 269 req = get_reserved_req(fc, file); 270 271 fuse_req_init_context(req); 272 req->waiting = 1; 273 req->background = 0; 274 return req; 275 } 276 277 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req) 278 { 279 if (atomic_dec_and_test(&req->count)) { 280 if (unlikely(req->background)) { 281 /* 282 * We get here in the unlikely case that a background 283 * request was allocated but not sent 284 */ 285 spin_lock(&fc->lock); 286 if (!fc->blocked) 287 wake_up(&fc->blocked_waitq); 288 spin_unlock(&fc->lock); 289 } 290 291 if (req->waiting) 292 atomic_dec(&fc->num_waiting); 293 294 if (req->stolen_file) 295 put_reserved_req(fc, req); 296 else 297 fuse_request_free(req); 298 } 299 } 300 EXPORT_SYMBOL_GPL(fuse_put_request); 301 302 static unsigned len_args(unsigned numargs, struct fuse_arg *args) 303 { 304 unsigned nbytes = 0; 305 unsigned i; 306 307 for (i = 0; i < numargs; i++) 308 nbytes += args[i].size; 309 310 return nbytes; 311 } 312 313 static u64 fuse_get_unique(struct fuse_conn *fc) 314 { 315 fc->reqctr++; 316 /* zero is special */ 317 if (fc->reqctr == 0) 318 fc->reqctr = 1; 319 320 return fc->reqctr; 321 } 322 323 static void queue_request(struct fuse_conn *fc, struct fuse_req *req) 324 { 325 req->in.h.len = sizeof(struct fuse_in_header) + 326 len_args(req->in.numargs, (struct fuse_arg *) req->in.args); 327 list_add_tail(&req->list, &fc->pending); 328 req->state = FUSE_REQ_PENDING; 329 if (!req->waiting) { 330 req->waiting = 1; 331 atomic_inc(&fc->num_waiting); 332 } 333 wake_up(&fc->waitq); 334 kill_fasync(&fc->fasync, SIGIO, POLL_IN); 335 } 336 337 void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, 338 u64 nodeid, u64 nlookup) 339 { 340 forget->forget_one.nodeid = nodeid; 341 forget->forget_one.nlookup = nlookup; 342 343 spin_lock(&fc->lock); 344 if (fc->connected) { 345 fc->forget_list_tail->next = forget; 346 fc->forget_list_tail = forget; 347 wake_up(&fc->waitq); 348 kill_fasync(&fc->fasync, SIGIO, POLL_IN); 349 } else { 350 kfree(forget); 351 } 352 spin_unlock(&fc->lock); 353 } 354 355 static void flush_bg_queue(struct fuse_conn *fc) 356 { 357 while (fc->active_background < fc->max_background && 358 !list_empty(&fc->bg_queue)) { 359 struct fuse_req *req; 360 361 req = list_entry(fc->bg_queue.next, struct fuse_req, list); 362 list_del(&req->list); 363 fc->active_background++; 364 req->in.h.unique = fuse_get_unique(fc); 365 queue_request(fc, req); 366 } 367 } 368 369 /* 370 * This function is called when a request is finished. Either a reply 371 * has arrived or it was aborted (and not yet sent) or some error 372 * occurred during communication with userspace, or the device file 373 * was closed. The requester thread is woken up (if still waiting), 374 * the 'end' callback is called if given, else the reference to the 375 * request is released 376 * 377 * Called with fc->lock, unlocks it 378 */ 379 static void request_end(struct fuse_conn *fc, struct fuse_req *req) 380 __releases(fc->lock) 381 { 382 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end; 383 req->end = NULL; 384 list_del(&req->list); 385 list_del(&req->intr_entry); 386 req->state = FUSE_REQ_FINISHED; 387 if (req->background) { 388 req->background = 0; 389 390 if (fc->num_background == fc->max_background) 391 fc->blocked = 0; 392 393 /* Wake up next waiter, if any */ 394 if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) 395 wake_up(&fc->blocked_waitq); 396 397 if (fc->num_background == fc->congestion_threshold && 398 fc->connected && fc->bdi_initialized) { 399 clear_bdi_congested(&fc->bdi, BLK_RW_SYNC); 400 clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC); 401 } 402 fc->num_background--; 403 fc->active_background--; 404 flush_bg_queue(fc); 405 } 406 spin_unlock(&fc->lock); 407 wake_up(&req->waitq); 408 if (end) 409 end(fc, req); 410 fuse_put_request(fc, req); 411 } 412 413 static void wait_answer_interruptible(struct fuse_conn *fc, 414 struct fuse_req *req) 415 __releases(fc->lock) 416 __acquires(fc->lock) 417 { 418 if (signal_pending(current)) 419 return; 420 421 spin_unlock(&fc->lock); 422 wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED); 423 spin_lock(&fc->lock); 424 } 425 426 static void queue_interrupt(struct fuse_conn *fc, struct fuse_req *req) 427 { 428 list_add_tail(&req->intr_entry, &fc->interrupts); 429 wake_up(&fc->waitq); 430 kill_fasync(&fc->fasync, SIGIO, POLL_IN); 431 } 432 433 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req) 434 __releases(fc->lock) 435 __acquires(fc->lock) 436 { 437 if (!fc->no_interrupt) { 438 /* Any signal may interrupt this */ 439 wait_answer_interruptible(fc, req); 440 441 if (req->aborted) 442 goto aborted; 443 if (req->state == FUSE_REQ_FINISHED) 444 return; 445 446 req->interrupted = 1; 447 if (req->state == FUSE_REQ_SENT) 448 queue_interrupt(fc, req); 449 } 450 451 if (!req->force) { 452 sigset_t oldset; 453 454 /* Only fatal signals may interrupt this */ 455 block_sigs(&oldset); 456 wait_answer_interruptible(fc, req); 457 restore_sigs(&oldset); 458 459 if (req->aborted) 460 goto aborted; 461 if (req->state == FUSE_REQ_FINISHED) 462 return; 463 464 /* Request is not yet in userspace, bail out */ 465 if (req->state == FUSE_REQ_PENDING) { 466 list_del(&req->list); 467 __fuse_put_request(req); 468 req->out.h.error = -EINTR; 469 return; 470 } 471 } 472 473 /* 474 * Either request is already in userspace, or it was forced. 475 * Wait it out. 476 */ 477 spin_unlock(&fc->lock); 478 wait_event(req->waitq, req->state == FUSE_REQ_FINISHED); 479 spin_lock(&fc->lock); 480 481 if (!req->aborted) 482 return; 483 484 aborted: 485 BUG_ON(req->state != FUSE_REQ_FINISHED); 486 if (req->locked) { 487 /* This is uninterruptible sleep, because data is 488 being copied to/from the buffers of req. During 489 locked state, there mustn't be any filesystem 490 operation (e.g. page fault), since that could lead 491 to deadlock */ 492 spin_unlock(&fc->lock); 493 wait_event(req->waitq, !req->locked); 494 spin_lock(&fc->lock); 495 } 496 } 497 498 static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) 499 { 500 BUG_ON(req->background); 501 spin_lock(&fc->lock); 502 if (!fc->connected) 503 req->out.h.error = -ENOTCONN; 504 else if (fc->conn_error) 505 req->out.h.error = -ECONNREFUSED; 506 else { 507 req->in.h.unique = fuse_get_unique(fc); 508 queue_request(fc, req); 509 /* acquire extra reference, since request is still needed 510 after request_end() */ 511 __fuse_get_request(req); 512 513 request_wait_answer(fc, req); 514 } 515 spin_unlock(&fc->lock); 516 } 517 518 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req) 519 { 520 req->isreply = 1; 521 __fuse_request_send(fc, req); 522 } 523 EXPORT_SYMBOL_GPL(fuse_request_send); 524 525 static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args) 526 { 527 if (fc->minor < 4 && args->in.h.opcode == FUSE_STATFS) 528 args->out.args[0].size = FUSE_COMPAT_STATFS_SIZE; 529 530 if (fc->minor < 9) { 531 switch (args->in.h.opcode) { 532 case FUSE_LOOKUP: 533 case FUSE_CREATE: 534 case FUSE_MKNOD: 535 case FUSE_MKDIR: 536 case FUSE_SYMLINK: 537 case FUSE_LINK: 538 args->out.args[0].size = FUSE_COMPAT_ENTRY_OUT_SIZE; 539 break; 540 case FUSE_GETATTR: 541 case FUSE_SETATTR: 542 args->out.args[0].size = FUSE_COMPAT_ATTR_OUT_SIZE; 543 break; 544 } 545 } 546 if (fc->minor < 12) { 547 switch (args->in.h.opcode) { 548 case FUSE_CREATE: 549 args->in.args[0].size = sizeof(struct fuse_open_in); 550 break; 551 case FUSE_MKNOD: 552 args->in.args[0].size = FUSE_COMPAT_MKNOD_IN_SIZE; 553 break; 554 } 555 } 556 } 557 558 ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args) 559 { 560 struct fuse_req *req; 561 ssize_t ret; 562 563 req = fuse_get_req(fc, 0); 564 if (IS_ERR(req)) 565 return PTR_ERR(req); 566 567 /* Needs to be done after fuse_get_req() so that fc->minor is valid */ 568 fuse_adjust_compat(fc, args); 569 570 req->in.h.opcode = args->in.h.opcode; 571 req->in.h.nodeid = args->in.h.nodeid; 572 req->in.numargs = args->in.numargs; 573 memcpy(req->in.args, args->in.args, 574 args->in.numargs * sizeof(struct fuse_in_arg)); 575 req->out.argvar = args->out.argvar; 576 req->out.numargs = args->out.numargs; 577 memcpy(req->out.args, args->out.args, 578 args->out.numargs * sizeof(struct fuse_arg)); 579 fuse_request_send(fc, req); 580 ret = req->out.h.error; 581 if (!ret && args->out.argvar) { 582 BUG_ON(args->out.numargs != 1); 583 ret = req->out.args[0].size; 584 } 585 fuse_put_request(fc, req); 586 587 return ret; 588 } 589 590 static void fuse_request_send_nowait_locked(struct fuse_conn *fc, 591 struct fuse_req *req) 592 { 593 BUG_ON(!req->background); 594 fc->num_background++; 595 if (fc->num_background == fc->max_background) 596 fc->blocked = 1; 597 if (fc->num_background == fc->congestion_threshold && 598 fc->bdi_initialized) { 599 set_bdi_congested(&fc->bdi, BLK_RW_SYNC); 600 set_bdi_congested(&fc->bdi, BLK_RW_ASYNC); 601 } 602 list_add_tail(&req->list, &fc->bg_queue); 603 flush_bg_queue(fc); 604 } 605 606 static void fuse_request_send_nowait(struct fuse_conn *fc, struct fuse_req *req) 607 { 608 spin_lock(&fc->lock); 609 if (fc->connected) { 610 fuse_request_send_nowait_locked(fc, req); 611 spin_unlock(&fc->lock); 612 } else { 613 req->out.h.error = -ENOTCONN; 614 request_end(fc, req); 615 } 616 } 617 618 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req) 619 { 620 req->isreply = 1; 621 fuse_request_send_nowait(fc, req); 622 } 623 EXPORT_SYMBOL_GPL(fuse_request_send_background); 624 625 static int fuse_request_send_notify_reply(struct fuse_conn *fc, 626 struct fuse_req *req, u64 unique) 627 { 628 int err = -ENODEV; 629 630 req->isreply = 0; 631 req->in.h.unique = unique; 632 spin_lock(&fc->lock); 633 if (fc->connected) { 634 queue_request(fc, req); 635 err = 0; 636 } 637 spin_unlock(&fc->lock); 638 639 return err; 640 } 641 642 /* 643 * Called under fc->lock 644 * 645 * fc->connected must have been checked previously 646 */ 647 void fuse_request_send_background_locked(struct fuse_conn *fc, 648 struct fuse_req *req) 649 { 650 req->isreply = 1; 651 fuse_request_send_nowait_locked(fc, req); 652 } 653 654 void fuse_force_forget(struct file *file, u64 nodeid) 655 { 656 struct inode *inode = file_inode(file); 657 struct fuse_conn *fc = get_fuse_conn(inode); 658 struct fuse_req *req; 659 struct fuse_forget_in inarg; 660 661 memset(&inarg, 0, sizeof(inarg)); 662 inarg.nlookup = 1; 663 req = fuse_get_req_nofail_nopages(fc, file); 664 req->in.h.opcode = FUSE_FORGET; 665 req->in.h.nodeid = nodeid; 666 req->in.numargs = 1; 667 req->in.args[0].size = sizeof(inarg); 668 req->in.args[0].value = &inarg; 669 req->isreply = 0; 670 __fuse_request_send(fc, req); 671 /* ignore errors */ 672 fuse_put_request(fc, req); 673 } 674 675 /* 676 * Lock the request. Up to the next unlock_request() there mustn't be 677 * anything that could cause a page-fault. If the request was already 678 * aborted bail out. 679 */ 680 static int lock_request(struct fuse_conn *fc, struct fuse_req *req) 681 { 682 int err = 0; 683 if (req) { 684 spin_lock(&fc->lock); 685 if (req->aborted) 686 err = -ENOENT; 687 else 688 req->locked = 1; 689 spin_unlock(&fc->lock); 690 } 691 return err; 692 } 693 694 /* 695 * Unlock request. If it was aborted during being locked, the 696 * requester thread is currently waiting for it to be unlocked, so 697 * wake it up. 698 */ 699 static void unlock_request(struct fuse_conn *fc, struct fuse_req *req) 700 { 701 if (req) { 702 spin_lock(&fc->lock); 703 req->locked = 0; 704 if (req->aborted) 705 wake_up(&req->waitq); 706 spin_unlock(&fc->lock); 707 } 708 } 709 710 struct fuse_copy_state { 711 struct fuse_conn *fc; 712 int write; 713 struct fuse_req *req; 714 const struct iovec *iov; 715 struct pipe_buffer *pipebufs; 716 struct pipe_buffer *currbuf; 717 struct pipe_inode_info *pipe; 718 unsigned long nr_segs; 719 unsigned long seglen; 720 unsigned long addr; 721 struct page *pg; 722 unsigned len; 723 unsigned offset; 724 unsigned move_pages:1; 725 }; 726 727 static void fuse_copy_init(struct fuse_copy_state *cs, struct fuse_conn *fc, 728 int write, 729 const struct iovec *iov, unsigned long nr_segs) 730 { 731 memset(cs, 0, sizeof(*cs)); 732 cs->fc = fc; 733 cs->write = write; 734 cs->iov = iov; 735 cs->nr_segs = nr_segs; 736 } 737 738 /* Unmap and put previous page of userspace buffer */ 739 static void fuse_copy_finish(struct fuse_copy_state *cs) 740 { 741 if (cs->currbuf) { 742 struct pipe_buffer *buf = cs->currbuf; 743 744 if (cs->write) 745 buf->len = PAGE_SIZE - cs->len; 746 cs->currbuf = NULL; 747 } else if (cs->pg) { 748 if (cs->write) { 749 flush_dcache_page(cs->pg); 750 set_page_dirty_lock(cs->pg); 751 } 752 put_page(cs->pg); 753 } 754 cs->pg = NULL; 755 } 756 757 /* 758 * Get another pagefull of userspace buffer, and map it to kernel 759 * address space, and lock request 760 */ 761 static int fuse_copy_fill(struct fuse_copy_state *cs) 762 { 763 struct page *page; 764 int err; 765 766 unlock_request(cs->fc, cs->req); 767 fuse_copy_finish(cs); 768 if (cs->pipebufs) { 769 struct pipe_buffer *buf = cs->pipebufs; 770 771 if (!cs->write) { 772 err = buf->ops->confirm(cs->pipe, buf); 773 if (err) 774 return err; 775 776 BUG_ON(!cs->nr_segs); 777 cs->currbuf = buf; 778 cs->pg = buf->page; 779 cs->offset = buf->offset; 780 cs->len = buf->len; 781 cs->pipebufs++; 782 cs->nr_segs--; 783 } else { 784 if (cs->nr_segs == cs->pipe->buffers) 785 return -EIO; 786 787 page = alloc_page(GFP_HIGHUSER); 788 if (!page) 789 return -ENOMEM; 790 791 buf->page = page; 792 buf->offset = 0; 793 buf->len = 0; 794 795 cs->currbuf = buf; 796 cs->pg = page; 797 cs->offset = 0; 798 cs->len = PAGE_SIZE; 799 cs->pipebufs++; 800 cs->nr_segs++; 801 } 802 } else { 803 if (!cs->seglen) { 804 BUG_ON(!cs->nr_segs); 805 cs->seglen = cs->iov[0].iov_len; 806 cs->addr = (unsigned long) cs->iov[0].iov_base; 807 cs->iov++; 808 cs->nr_segs--; 809 } 810 err = get_user_pages_fast(cs->addr, 1, cs->write, &page); 811 if (err < 0) 812 return err; 813 BUG_ON(err != 1); 814 cs->pg = page; 815 cs->offset = cs->addr % PAGE_SIZE; 816 cs->len = min(PAGE_SIZE - cs->offset, cs->seglen); 817 cs->seglen -= cs->len; 818 cs->addr += cs->len; 819 } 820 821 return lock_request(cs->fc, cs->req); 822 } 823 824 /* Do as much copy to/from userspace buffer as we can */ 825 static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size) 826 { 827 unsigned ncpy = min(*size, cs->len); 828 if (val) { 829 void *pgaddr = kmap_atomic(cs->pg); 830 void *buf = pgaddr + cs->offset; 831 832 if (cs->write) 833 memcpy(buf, *val, ncpy); 834 else 835 memcpy(*val, buf, ncpy); 836 837 kunmap_atomic(pgaddr); 838 *val += ncpy; 839 } 840 *size -= ncpy; 841 cs->len -= ncpy; 842 cs->offset += ncpy; 843 return ncpy; 844 } 845 846 static int fuse_check_page(struct page *page) 847 { 848 if (page_mapcount(page) || 849 page->mapping != NULL || 850 page_count(page) != 1 || 851 (page->flags & PAGE_FLAGS_CHECK_AT_PREP & 852 ~(1 << PG_locked | 853 1 << PG_referenced | 854 1 << PG_uptodate | 855 1 << PG_lru | 856 1 << PG_active | 857 1 << PG_reclaim))) { 858 printk(KERN_WARNING "fuse: trying to steal weird page\n"); 859 printk(KERN_WARNING " page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping); 860 return 1; 861 } 862 return 0; 863 } 864 865 static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) 866 { 867 int err; 868 struct page *oldpage = *pagep; 869 struct page *newpage; 870 struct pipe_buffer *buf = cs->pipebufs; 871 872 unlock_request(cs->fc, cs->req); 873 fuse_copy_finish(cs); 874 875 err = buf->ops->confirm(cs->pipe, buf); 876 if (err) 877 return err; 878 879 BUG_ON(!cs->nr_segs); 880 cs->currbuf = buf; 881 cs->len = buf->len; 882 cs->pipebufs++; 883 cs->nr_segs--; 884 885 if (cs->len != PAGE_SIZE) 886 goto out_fallback; 887 888 if (buf->ops->steal(cs->pipe, buf) != 0) 889 goto out_fallback; 890 891 newpage = buf->page; 892 893 if (!PageUptodate(newpage)) 894 SetPageUptodate(newpage); 895 896 ClearPageMappedToDisk(newpage); 897 898 if (fuse_check_page(newpage) != 0) 899 goto out_fallback_unlock; 900 901 /* 902 * This is a new and locked page, it shouldn't be mapped or 903 * have any special flags on it 904 */ 905 if (WARN_ON(page_mapped(oldpage))) 906 goto out_fallback_unlock; 907 if (WARN_ON(page_has_private(oldpage))) 908 goto out_fallback_unlock; 909 if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage))) 910 goto out_fallback_unlock; 911 if (WARN_ON(PageMlocked(oldpage))) 912 goto out_fallback_unlock; 913 914 err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL); 915 if (err) { 916 unlock_page(newpage); 917 return err; 918 } 919 920 page_cache_get(newpage); 921 922 if (!(buf->flags & PIPE_BUF_FLAG_LRU)) 923 lru_cache_add_file(newpage); 924 925 err = 0; 926 spin_lock(&cs->fc->lock); 927 if (cs->req->aborted) 928 err = -ENOENT; 929 else 930 *pagep = newpage; 931 spin_unlock(&cs->fc->lock); 932 933 if (err) { 934 unlock_page(newpage); 935 page_cache_release(newpage); 936 return err; 937 } 938 939 unlock_page(oldpage); 940 page_cache_release(oldpage); 941 cs->len = 0; 942 943 return 0; 944 945 out_fallback_unlock: 946 unlock_page(newpage); 947 out_fallback: 948 cs->pg = buf->page; 949 cs->offset = buf->offset; 950 951 err = lock_request(cs->fc, cs->req); 952 if (err) 953 return err; 954 955 return 1; 956 } 957 958 static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, 959 unsigned offset, unsigned count) 960 { 961 struct pipe_buffer *buf; 962 963 if (cs->nr_segs == cs->pipe->buffers) 964 return -EIO; 965 966 unlock_request(cs->fc, cs->req); 967 fuse_copy_finish(cs); 968 969 buf = cs->pipebufs; 970 page_cache_get(page); 971 buf->page = page; 972 buf->offset = offset; 973 buf->len = count; 974 975 cs->pipebufs++; 976 cs->nr_segs++; 977 cs->len = 0; 978 979 return 0; 980 } 981 982 /* 983 * Copy a page in the request to/from the userspace buffer. Must be 984 * done atomically 985 */ 986 static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep, 987 unsigned offset, unsigned count, int zeroing) 988 { 989 int err; 990 struct page *page = *pagep; 991 992 if (page && zeroing && count < PAGE_SIZE) 993 clear_highpage(page); 994 995 while (count) { 996 if (cs->write && cs->pipebufs && page) { 997 return fuse_ref_page(cs, page, offset, count); 998 } else if (!cs->len) { 999 if (cs->move_pages && page && 1000 offset == 0 && count == PAGE_SIZE) { 1001 err = fuse_try_move_page(cs, pagep); 1002 if (err <= 0) 1003 return err; 1004 } else { 1005 err = fuse_copy_fill(cs); 1006 if (err) 1007 return err; 1008 } 1009 } 1010 if (page) { 1011 void *mapaddr = kmap_atomic(page); 1012 void *buf = mapaddr + offset; 1013 offset += fuse_copy_do(cs, &buf, &count); 1014 kunmap_atomic(mapaddr); 1015 } else 1016 offset += fuse_copy_do(cs, NULL, &count); 1017 } 1018 if (page && !cs->write) 1019 flush_dcache_page(page); 1020 return 0; 1021 } 1022 1023 /* Copy pages in the request to/from userspace buffer */ 1024 static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes, 1025 int zeroing) 1026 { 1027 unsigned i; 1028 struct fuse_req *req = cs->req; 1029 1030 for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) { 1031 int err; 1032 unsigned offset = req->page_descs[i].offset; 1033 unsigned count = min(nbytes, req->page_descs[i].length); 1034 1035 err = fuse_copy_page(cs, &req->pages[i], offset, count, 1036 zeroing); 1037 if (err) 1038 return err; 1039 1040 nbytes -= count; 1041 } 1042 return 0; 1043 } 1044 1045 /* Copy a single argument in the request to/from userspace buffer */ 1046 static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size) 1047 { 1048 while (size) { 1049 if (!cs->len) { 1050 int err = fuse_copy_fill(cs); 1051 if (err) 1052 return err; 1053 } 1054 fuse_copy_do(cs, &val, &size); 1055 } 1056 return 0; 1057 } 1058 1059 /* Copy request arguments to/from userspace buffer */ 1060 static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs, 1061 unsigned argpages, struct fuse_arg *args, 1062 int zeroing) 1063 { 1064 int err = 0; 1065 unsigned i; 1066 1067 for (i = 0; !err && i < numargs; i++) { 1068 struct fuse_arg *arg = &args[i]; 1069 if (i == numargs - 1 && argpages) 1070 err = fuse_copy_pages(cs, arg->size, zeroing); 1071 else 1072 err = fuse_copy_one(cs, arg->value, arg->size); 1073 } 1074 return err; 1075 } 1076 1077 static int forget_pending(struct fuse_conn *fc) 1078 { 1079 return fc->forget_list_head.next != NULL; 1080 } 1081 1082 static int request_pending(struct fuse_conn *fc) 1083 { 1084 return !list_empty(&fc->pending) || !list_empty(&fc->interrupts) || 1085 forget_pending(fc); 1086 } 1087 1088 /* Wait until a request is available on the pending list */ 1089 static void request_wait(struct fuse_conn *fc) 1090 __releases(fc->lock) 1091 __acquires(fc->lock) 1092 { 1093 DECLARE_WAITQUEUE(wait, current); 1094 1095 add_wait_queue_exclusive(&fc->waitq, &wait); 1096 while (fc->connected && !request_pending(fc)) { 1097 set_current_state(TASK_INTERRUPTIBLE); 1098 if (signal_pending(current)) 1099 break; 1100 1101 spin_unlock(&fc->lock); 1102 schedule(); 1103 spin_lock(&fc->lock); 1104 } 1105 set_current_state(TASK_RUNNING); 1106 remove_wait_queue(&fc->waitq, &wait); 1107 } 1108 1109 /* 1110 * Transfer an interrupt request to userspace 1111 * 1112 * Unlike other requests this is assembled on demand, without a need 1113 * to allocate a separate fuse_req structure. 1114 * 1115 * Called with fc->lock held, releases it 1116 */ 1117 static int fuse_read_interrupt(struct fuse_conn *fc, struct fuse_copy_state *cs, 1118 size_t nbytes, struct fuse_req *req) 1119 __releases(fc->lock) 1120 { 1121 struct fuse_in_header ih; 1122 struct fuse_interrupt_in arg; 1123 unsigned reqsize = sizeof(ih) + sizeof(arg); 1124 int err; 1125 1126 list_del_init(&req->intr_entry); 1127 req->intr_unique = fuse_get_unique(fc); 1128 memset(&ih, 0, sizeof(ih)); 1129 memset(&arg, 0, sizeof(arg)); 1130 ih.len = reqsize; 1131 ih.opcode = FUSE_INTERRUPT; 1132 ih.unique = req->intr_unique; 1133 arg.unique = req->in.h.unique; 1134 1135 spin_unlock(&fc->lock); 1136 if (nbytes < reqsize) 1137 return -EINVAL; 1138 1139 err = fuse_copy_one(cs, &ih, sizeof(ih)); 1140 if (!err) 1141 err = fuse_copy_one(cs, &arg, sizeof(arg)); 1142 fuse_copy_finish(cs); 1143 1144 return err ? err : reqsize; 1145 } 1146 1147 static struct fuse_forget_link *dequeue_forget(struct fuse_conn *fc, 1148 unsigned max, 1149 unsigned *countp) 1150 { 1151 struct fuse_forget_link *head = fc->forget_list_head.next; 1152 struct fuse_forget_link **newhead = &head; 1153 unsigned count; 1154 1155 for (count = 0; *newhead != NULL && count < max; count++) 1156 newhead = &(*newhead)->next; 1157 1158 fc->forget_list_head.next = *newhead; 1159 *newhead = NULL; 1160 if (fc->forget_list_head.next == NULL) 1161 fc->forget_list_tail = &fc->forget_list_head; 1162 1163 if (countp != NULL) 1164 *countp = count; 1165 1166 return head; 1167 } 1168 1169 static int fuse_read_single_forget(struct fuse_conn *fc, 1170 struct fuse_copy_state *cs, 1171 size_t nbytes) 1172 __releases(fc->lock) 1173 { 1174 int err; 1175 struct fuse_forget_link *forget = dequeue_forget(fc, 1, NULL); 1176 struct fuse_forget_in arg = { 1177 .nlookup = forget->forget_one.nlookup, 1178 }; 1179 struct fuse_in_header ih = { 1180 .opcode = FUSE_FORGET, 1181 .nodeid = forget->forget_one.nodeid, 1182 .unique = fuse_get_unique(fc), 1183 .len = sizeof(ih) + sizeof(arg), 1184 }; 1185 1186 spin_unlock(&fc->lock); 1187 kfree(forget); 1188 if (nbytes < ih.len) 1189 return -EINVAL; 1190 1191 err = fuse_copy_one(cs, &ih, sizeof(ih)); 1192 if (!err) 1193 err = fuse_copy_one(cs, &arg, sizeof(arg)); 1194 fuse_copy_finish(cs); 1195 1196 if (err) 1197 return err; 1198 1199 return ih.len; 1200 } 1201 1202 static int fuse_read_batch_forget(struct fuse_conn *fc, 1203 struct fuse_copy_state *cs, size_t nbytes) 1204 __releases(fc->lock) 1205 { 1206 int err; 1207 unsigned max_forgets; 1208 unsigned count; 1209 struct fuse_forget_link *head; 1210 struct fuse_batch_forget_in arg = { .count = 0 }; 1211 struct fuse_in_header ih = { 1212 .opcode = FUSE_BATCH_FORGET, 1213 .unique = fuse_get_unique(fc), 1214 .len = sizeof(ih) + sizeof(arg), 1215 }; 1216 1217 if (nbytes < ih.len) { 1218 spin_unlock(&fc->lock); 1219 return -EINVAL; 1220 } 1221 1222 max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one); 1223 head = dequeue_forget(fc, max_forgets, &count); 1224 spin_unlock(&fc->lock); 1225 1226 arg.count = count; 1227 ih.len += count * sizeof(struct fuse_forget_one); 1228 err = fuse_copy_one(cs, &ih, sizeof(ih)); 1229 if (!err) 1230 err = fuse_copy_one(cs, &arg, sizeof(arg)); 1231 1232 while (head) { 1233 struct fuse_forget_link *forget = head; 1234 1235 if (!err) { 1236 err = fuse_copy_one(cs, &forget->forget_one, 1237 sizeof(forget->forget_one)); 1238 } 1239 head = forget->next; 1240 kfree(forget); 1241 } 1242 1243 fuse_copy_finish(cs); 1244 1245 if (err) 1246 return err; 1247 1248 return ih.len; 1249 } 1250 1251 static int fuse_read_forget(struct fuse_conn *fc, struct fuse_copy_state *cs, 1252 size_t nbytes) 1253 __releases(fc->lock) 1254 { 1255 if (fc->minor < 16 || fc->forget_list_head.next->next == NULL) 1256 return fuse_read_single_forget(fc, cs, nbytes); 1257 else 1258 return fuse_read_batch_forget(fc, cs, nbytes); 1259 } 1260 1261 /* 1262 * Read a single request into the userspace filesystem's buffer. This 1263 * function waits until a request is available, then removes it from 1264 * the pending list and copies request data to userspace buffer. If 1265 * no reply is needed (FORGET) or request has been aborted or there 1266 * was an error during the copying then it's finished by calling 1267 * request_end(). Otherwise add it to the processing list, and set 1268 * the 'sent' flag. 1269 */ 1270 static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file, 1271 struct fuse_copy_state *cs, size_t nbytes) 1272 { 1273 int err; 1274 struct fuse_req *req; 1275 struct fuse_in *in; 1276 unsigned reqsize; 1277 1278 restart: 1279 spin_lock(&fc->lock); 1280 err = -EAGAIN; 1281 if ((file->f_flags & O_NONBLOCK) && fc->connected && 1282 !request_pending(fc)) 1283 goto err_unlock; 1284 1285 request_wait(fc); 1286 err = -ENODEV; 1287 if (!fc->connected) 1288 goto err_unlock; 1289 err = -ERESTARTSYS; 1290 if (!request_pending(fc)) 1291 goto err_unlock; 1292 1293 if (!list_empty(&fc->interrupts)) { 1294 req = list_entry(fc->interrupts.next, struct fuse_req, 1295 intr_entry); 1296 return fuse_read_interrupt(fc, cs, nbytes, req); 1297 } 1298 1299 if (forget_pending(fc)) { 1300 if (list_empty(&fc->pending) || fc->forget_batch-- > 0) 1301 return fuse_read_forget(fc, cs, nbytes); 1302 1303 if (fc->forget_batch <= -8) 1304 fc->forget_batch = 16; 1305 } 1306 1307 req = list_entry(fc->pending.next, struct fuse_req, list); 1308 req->state = FUSE_REQ_READING; 1309 list_move(&req->list, &fc->io); 1310 1311 in = &req->in; 1312 reqsize = in->h.len; 1313 /* If request is too large, reply with an error and restart the read */ 1314 if (nbytes < reqsize) { 1315 req->out.h.error = -EIO; 1316 /* SETXATTR is special, since it may contain too large data */ 1317 if (in->h.opcode == FUSE_SETXATTR) 1318 req->out.h.error = -E2BIG; 1319 request_end(fc, req); 1320 goto restart; 1321 } 1322 spin_unlock(&fc->lock); 1323 cs->req = req; 1324 err = fuse_copy_one(cs, &in->h, sizeof(in->h)); 1325 if (!err) 1326 err = fuse_copy_args(cs, in->numargs, in->argpages, 1327 (struct fuse_arg *) in->args, 0); 1328 fuse_copy_finish(cs); 1329 spin_lock(&fc->lock); 1330 req->locked = 0; 1331 if (req->aborted) { 1332 request_end(fc, req); 1333 return -ENODEV; 1334 } 1335 if (err) { 1336 req->out.h.error = -EIO; 1337 request_end(fc, req); 1338 return err; 1339 } 1340 if (!req->isreply) 1341 request_end(fc, req); 1342 else { 1343 req->state = FUSE_REQ_SENT; 1344 list_move_tail(&req->list, &fc->processing); 1345 if (req->interrupted) 1346 queue_interrupt(fc, req); 1347 spin_unlock(&fc->lock); 1348 } 1349 return reqsize; 1350 1351 err_unlock: 1352 spin_unlock(&fc->lock); 1353 return err; 1354 } 1355 1356 static int fuse_dev_open(struct inode *inode, struct file *file) 1357 { 1358 /* 1359 * The fuse device's file's private_data is used to hold 1360 * the fuse_conn(ection) when it is mounted, and is used to 1361 * keep track of whether the file has been mounted already. 1362 */ 1363 file->private_data = NULL; 1364 return 0; 1365 } 1366 1367 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov, 1368 unsigned long nr_segs, loff_t pos) 1369 { 1370 struct fuse_copy_state cs; 1371 struct file *file = iocb->ki_filp; 1372 struct fuse_conn *fc = fuse_get_conn(file); 1373 if (!fc) 1374 return -EPERM; 1375 1376 fuse_copy_init(&cs, fc, 1, iov, nr_segs); 1377 1378 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs)); 1379 } 1380 1381 static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos, 1382 struct pipe_inode_info *pipe, 1383 size_t len, unsigned int flags) 1384 { 1385 int ret; 1386 int page_nr = 0; 1387 int do_wakeup = 0; 1388 struct pipe_buffer *bufs; 1389 struct fuse_copy_state cs; 1390 struct fuse_conn *fc = fuse_get_conn(in); 1391 if (!fc) 1392 return -EPERM; 1393 1394 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 1395 if (!bufs) 1396 return -ENOMEM; 1397 1398 fuse_copy_init(&cs, fc, 1, NULL, 0); 1399 cs.pipebufs = bufs; 1400 cs.pipe = pipe; 1401 ret = fuse_dev_do_read(fc, in, &cs, len); 1402 if (ret < 0) 1403 goto out; 1404 1405 ret = 0; 1406 pipe_lock(pipe); 1407 1408 if (!pipe->readers) { 1409 send_sig(SIGPIPE, current, 0); 1410 if (!ret) 1411 ret = -EPIPE; 1412 goto out_unlock; 1413 } 1414 1415 if (pipe->nrbufs + cs.nr_segs > pipe->buffers) { 1416 ret = -EIO; 1417 goto out_unlock; 1418 } 1419 1420 while (page_nr < cs.nr_segs) { 1421 int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1); 1422 struct pipe_buffer *buf = pipe->bufs + newbuf; 1423 1424 buf->page = bufs[page_nr].page; 1425 buf->offset = bufs[page_nr].offset; 1426 buf->len = bufs[page_nr].len; 1427 /* 1428 * Need to be careful about this. Having buf->ops in module 1429 * code can Oops if the buffer persists after module unload. 1430 */ 1431 buf->ops = &nosteal_pipe_buf_ops; 1432 1433 pipe->nrbufs++; 1434 page_nr++; 1435 ret += buf->len; 1436 1437 if (pipe->files) 1438 do_wakeup = 1; 1439 } 1440 1441 out_unlock: 1442 pipe_unlock(pipe); 1443 1444 if (do_wakeup) { 1445 smp_mb(); 1446 if (waitqueue_active(&pipe->wait)) 1447 wake_up_interruptible(&pipe->wait); 1448 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 1449 } 1450 1451 out: 1452 for (; page_nr < cs.nr_segs; page_nr++) 1453 page_cache_release(bufs[page_nr].page); 1454 1455 kfree(bufs); 1456 return ret; 1457 } 1458 1459 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size, 1460 struct fuse_copy_state *cs) 1461 { 1462 struct fuse_notify_poll_wakeup_out outarg; 1463 int err = -EINVAL; 1464 1465 if (size != sizeof(outarg)) 1466 goto err; 1467 1468 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1469 if (err) 1470 goto err; 1471 1472 fuse_copy_finish(cs); 1473 return fuse_notify_poll_wakeup(fc, &outarg); 1474 1475 err: 1476 fuse_copy_finish(cs); 1477 return err; 1478 } 1479 1480 static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size, 1481 struct fuse_copy_state *cs) 1482 { 1483 struct fuse_notify_inval_inode_out outarg; 1484 int err = -EINVAL; 1485 1486 if (size != sizeof(outarg)) 1487 goto err; 1488 1489 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1490 if (err) 1491 goto err; 1492 fuse_copy_finish(cs); 1493 1494 down_read(&fc->killsb); 1495 err = -ENOENT; 1496 if (fc->sb) { 1497 err = fuse_reverse_inval_inode(fc->sb, outarg.ino, 1498 outarg.off, outarg.len); 1499 } 1500 up_read(&fc->killsb); 1501 return err; 1502 1503 err: 1504 fuse_copy_finish(cs); 1505 return err; 1506 } 1507 1508 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size, 1509 struct fuse_copy_state *cs) 1510 { 1511 struct fuse_notify_inval_entry_out outarg; 1512 int err = -ENOMEM; 1513 char *buf; 1514 struct qstr name; 1515 1516 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL); 1517 if (!buf) 1518 goto err; 1519 1520 err = -EINVAL; 1521 if (size < sizeof(outarg)) 1522 goto err; 1523 1524 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1525 if (err) 1526 goto err; 1527 1528 err = -ENAMETOOLONG; 1529 if (outarg.namelen > FUSE_NAME_MAX) 1530 goto err; 1531 1532 err = -EINVAL; 1533 if (size != sizeof(outarg) + outarg.namelen + 1) 1534 goto err; 1535 1536 name.name = buf; 1537 name.len = outarg.namelen; 1538 err = fuse_copy_one(cs, buf, outarg.namelen + 1); 1539 if (err) 1540 goto err; 1541 fuse_copy_finish(cs); 1542 buf[outarg.namelen] = 0; 1543 name.hash = full_name_hash(name.name, name.len); 1544 1545 down_read(&fc->killsb); 1546 err = -ENOENT; 1547 if (fc->sb) 1548 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name); 1549 up_read(&fc->killsb); 1550 kfree(buf); 1551 return err; 1552 1553 err: 1554 kfree(buf); 1555 fuse_copy_finish(cs); 1556 return err; 1557 } 1558 1559 static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size, 1560 struct fuse_copy_state *cs) 1561 { 1562 struct fuse_notify_delete_out outarg; 1563 int err = -ENOMEM; 1564 char *buf; 1565 struct qstr name; 1566 1567 buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL); 1568 if (!buf) 1569 goto err; 1570 1571 err = -EINVAL; 1572 if (size < sizeof(outarg)) 1573 goto err; 1574 1575 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1576 if (err) 1577 goto err; 1578 1579 err = -ENAMETOOLONG; 1580 if (outarg.namelen > FUSE_NAME_MAX) 1581 goto err; 1582 1583 err = -EINVAL; 1584 if (size != sizeof(outarg) + outarg.namelen + 1) 1585 goto err; 1586 1587 name.name = buf; 1588 name.len = outarg.namelen; 1589 err = fuse_copy_one(cs, buf, outarg.namelen + 1); 1590 if (err) 1591 goto err; 1592 fuse_copy_finish(cs); 1593 buf[outarg.namelen] = 0; 1594 name.hash = full_name_hash(name.name, name.len); 1595 1596 down_read(&fc->killsb); 1597 err = -ENOENT; 1598 if (fc->sb) 1599 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 1600 outarg.child, &name); 1601 up_read(&fc->killsb); 1602 kfree(buf); 1603 return err; 1604 1605 err: 1606 kfree(buf); 1607 fuse_copy_finish(cs); 1608 return err; 1609 } 1610 1611 static int fuse_notify_store(struct fuse_conn *fc, unsigned int size, 1612 struct fuse_copy_state *cs) 1613 { 1614 struct fuse_notify_store_out outarg; 1615 struct inode *inode; 1616 struct address_space *mapping; 1617 u64 nodeid; 1618 int err; 1619 pgoff_t index; 1620 unsigned int offset; 1621 unsigned int num; 1622 loff_t file_size; 1623 loff_t end; 1624 1625 err = -EINVAL; 1626 if (size < sizeof(outarg)) 1627 goto out_finish; 1628 1629 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1630 if (err) 1631 goto out_finish; 1632 1633 err = -EINVAL; 1634 if (size - sizeof(outarg) != outarg.size) 1635 goto out_finish; 1636 1637 nodeid = outarg.nodeid; 1638 1639 down_read(&fc->killsb); 1640 1641 err = -ENOENT; 1642 if (!fc->sb) 1643 goto out_up_killsb; 1644 1645 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid); 1646 if (!inode) 1647 goto out_up_killsb; 1648 1649 mapping = inode->i_mapping; 1650 index = outarg.offset >> PAGE_CACHE_SHIFT; 1651 offset = outarg.offset & ~PAGE_CACHE_MASK; 1652 file_size = i_size_read(inode); 1653 end = outarg.offset + outarg.size; 1654 if (end > file_size) { 1655 file_size = end; 1656 fuse_write_update_size(inode, file_size); 1657 } 1658 1659 num = outarg.size; 1660 while (num) { 1661 struct page *page; 1662 unsigned int this_num; 1663 1664 err = -ENOMEM; 1665 page = find_or_create_page(mapping, index, 1666 mapping_gfp_mask(mapping)); 1667 if (!page) 1668 goto out_iput; 1669 1670 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset); 1671 err = fuse_copy_page(cs, &page, offset, this_num, 0); 1672 if (!err && offset == 0 && 1673 (this_num == PAGE_CACHE_SIZE || file_size == end)) 1674 SetPageUptodate(page); 1675 unlock_page(page); 1676 page_cache_release(page); 1677 1678 if (err) 1679 goto out_iput; 1680 1681 num -= this_num; 1682 offset = 0; 1683 index++; 1684 } 1685 1686 err = 0; 1687 1688 out_iput: 1689 iput(inode); 1690 out_up_killsb: 1691 up_read(&fc->killsb); 1692 out_finish: 1693 fuse_copy_finish(cs); 1694 return err; 1695 } 1696 1697 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req) 1698 { 1699 release_pages(req->pages, req->num_pages, false); 1700 } 1701 1702 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, 1703 struct fuse_notify_retrieve_out *outarg) 1704 { 1705 int err; 1706 struct address_space *mapping = inode->i_mapping; 1707 struct fuse_req *req; 1708 pgoff_t index; 1709 loff_t file_size; 1710 unsigned int num; 1711 unsigned int offset; 1712 size_t total_len = 0; 1713 int num_pages; 1714 1715 offset = outarg->offset & ~PAGE_CACHE_MASK; 1716 file_size = i_size_read(inode); 1717 1718 num = outarg->size; 1719 if (outarg->offset > file_size) 1720 num = 0; 1721 else if (outarg->offset + num > file_size) 1722 num = file_size - outarg->offset; 1723 1724 num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT; 1725 num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ); 1726 1727 req = fuse_get_req(fc, num_pages); 1728 if (IS_ERR(req)) 1729 return PTR_ERR(req); 1730 1731 req->in.h.opcode = FUSE_NOTIFY_REPLY; 1732 req->in.h.nodeid = outarg->nodeid; 1733 req->in.numargs = 2; 1734 req->in.argpages = 1; 1735 req->page_descs[0].offset = offset; 1736 req->end = fuse_retrieve_end; 1737 1738 index = outarg->offset >> PAGE_CACHE_SHIFT; 1739 1740 while (num && req->num_pages < num_pages) { 1741 struct page *page; 1742 unsigned int this_num; 1743 1744 page = find_get_page(mapping, index); 1745 if (!page) 1746 break; 1747 1748 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset); 1749 req->pages[req->num_pages] = page; 1750 req->page_descs[req->num_pages].length = this_num; 1751 req->num_pages++; 1752 1753 offset = 0; 1754 num -= this_num; 1755 total_len += this_num; 1756 index++; 1757 } 1758 req->misc.retrieve_in.offset = outarg->offset; 1759 req->misc.retrieve_in.size = total_len; 1760 req->in.args[0].size = sizeof(req->misc.retrieve_in); 1761 req->in.args[0].value = &req->misc.retrieve_in; 1762 req->in.args[1].size = total_len; 1763 1764 err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); 1765 if (err) 1766 fuse_retrieve_end(fc, req); 1767 1768 return err; 1769 } 1770 1771 static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size, 1772 struct fuse_copy_state *cs) 1773 { 1774 struct fuse_notify_retrieve_out outarg; 1775 struct inode *inode; 1776 int err; 1777 1778 err = -EINVAL; 1779 if (size != sizeof(outarg)) 1780 goto copy_finish; 1781 1782 err = fuse_copy_one(cs, &outarg, sizeof(outarg)); 1783 if (err) 1784 goto copy_finish; 1785 1786 fuse_copy_finish(cs); 1787 1788 down_read(&fc->killsb); 1789 err = -ENOENT; 1790 if (fc->sb) { 1791 u64 nodeid = outarg.nodeid; 1792 1793 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid); 1794 if (inode) { 1795 err = fuse_retrieve(fc, inode, &outarg); 1796 iput(inode); 1797 } 1798 } 1799 up_read(&fc->killsb); 1800 1801 return err; 1802 1803 copy_finish: 1804 fuse_copy_finish(cs); 1805 return err; 1806 } 1807 1808 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code, 1809 unsigned int size, struct fuse_copy_state *cs) 1810 { 1811 /* Don't try to move pages (yet) */ 1812 cs->move_pages = 0; 1813 1814 switch (code) { 1815 case FUSE_NOTIFY_POLL: 1816 return fuse_notify_poll(fc, size, cs); 1817 1818 case FUSE_NOTIFY_INVAL_INODE: 1819 return fuse_notify_inval_inode(fc, size, cs); 1820 1821 case FUSE_NOTIFY_INVAL_ENTRY: 1822 return fuse_notify_inval_entry(fc, size, cs); 1823 1824 case FUSE_NOTIFY_STORE: 1825 return fuse_notify_store(fc, size, cs); 1826 1827 case FUSE_NOTIFY_RETRIEVE: 1828 return fuse_notify_retrieve(fc, size, cs); 1829 1830 case FUSE_NOTIFY_DELETE: 1831 return fuse_notify_delete(fc, size, cs); 1832 1833 default: 1834 fuse_copy_finish(cs); 1835 return -EINVAL; 1836 } 1837 } 1838 1839 /* Look up request on processing list by unique ID */ 1840 static struct fuse_req *request_find(struct fuse_conn *fc, u64 unique) 1841 { 1842 struct fuse_req *req; 1843 1844 list_for_each_entry(req, &fc->processing, list) { 1845 if (req->in.h.unique == unique || req->intr_unique == unique) 1846 return req; 1847 } 1848 return NULL; 1849 } 1850 1851 static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out, 1852 unsigned nbytes) 1853 { 1854 unsigned reqsize = sizeof(struct fuse_out_header); 1855 1856 if (out->h.error) 1857 return nbytes != reqsize ? -EINVAL : 0; 1858 1859 reqsize += len_args(out->numargs, out->args); 1860 1861 if (reqsize < nbytes || (reqsize > nbytes && !out->argvar)) 1862 return -EINVAL; 1863 else if (reqsize > nbytes) { 1864 struct fuse_arg *lastarg = &out->args[out->numargs-1]; 1865 unsigned diffsize = reqsize - nbytes; 1866 if (diffsize > lastarg->size) 1867 return -EINVAL; 1868 lastarg->size -= diffsize; 1869 } 1870 return fuse_copy_args(cs, out->numargs, out->argpages, out->args, 1871 out->page_zeroing); 1872 } 1873 1874 /* 1875 * Write a single reply to a request. First the header is copied from 1876 * the write buffer. The request is then searched on the processing 1877 * list by the unique ID found in the header. If found, then remove 1878 * it from the list and copy the rest of the buffer to the request. 1879 * The request is finished by calling request_end() 1880 */ 1881 static ssize_t fuse_dev_do_write(struct fuse_conn *fc, 1882 struct fuse_copy_state *cs, size_t nbytes) 1883 { 1884 int err; 1885 struct fuse_req *req; 1886 struct fuse_out_header oh; 1887 1888 if (nbytes < sizeof(struct fuse_out_header)) 1889 return -EINVAL; 1890 1891 err = fuse_copy_one(cs, &oh, sizeof(oh)); 1892 if (err) 1893 goto err_finish; 1894 1895 err = -EINVAL; 1896 if (oh.len != nbytes) 1897 goto err_finish; 1898 1899 /* 1900 * Zero oh.unique indicates unsolicited notification message 1901 * and error contains notification code. 1902 */ 1903 if (!oh.unique) { 1904 err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs); 1905 return err ? err : nbytes; 1906 } 1907 1908 err = -EINVAL; 1909 if (oh.error <= -1000 || oh.error > 0) 1910 goto err_finish; 1911 1912 spin_lock(&fc->lock); 1913 err = -ENOENT; 1914 if (!fc->connected) 1915 goto err_unlock; 1916 1917 req = request_find(fc, oh.unique); 1918 if (!req) 1919 goto err_unlock; 1920 1921 if (req->aborted) { 1922 spin_unlock(&fc->lock); 1923 fuse_copy_finish(cs); 1924 spin_lock(&fc->lock); 1925 request_end(fc, req); 1926 return -ENOENT; 1927 } 1928 /* Is it an interrupt reply? */ 1929 if (req->intr_unique == oh.unique) { 1930 err = -EINVAL; 1931 if (nbytes != sizeof(struct fuse_out_header)) 1932 goto err_unlock; 1933 1934 if (oh.error == -ENOSYS) 1935 fc->no_interrupt = 1; 1936 else if (oh.error == -EAGAIN) 1937 queue_interrupt(fc, req); 1938 1939 spin_unlock(&fc->lock); 1940 fuse_copy_finish(cs); 1941 return nbytes; 1942 } 1943 1944 req->state = FUSE_REQ_WRITING; 1945 list_move(&req->list, &fc->io); 1946 req->out.h = oh; 1947 req->locked = 1; 1948 cs->req = req; 1949 if (!req->out.page_replace) 1950 cs->move_pages = 0; 1951 spin_unlock(&fc->lock); 1952 1953 err = copy_out_args(cs, &req->out, nbytes); 1954 fuse_copy_finish(cs); 1955 1956 spin_lock(&fc->lock); 1957 req->locked = 0; 1958 if (!err) { 1959 if (req->aborted) 1960 err = -ENOENT; 1961 } else if (!req->aborted) 1962 req->out.h.error = -EIO; 1963 request_end(fc, req); 1964 1965 return err ? err : nbytes; 1966 1967 err_unlock: 1968 spin_unlock(&fc->lock); 1969 err_finish: 1970 fuse_copy_finish(cs); 1971 return err; 1972 } 1973 1974 static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov, 1975 unsigned long nr_segs, loff_t pos) 1976 { 1977 struct fuse_copy_state cs; 1978 struct fuse_conn *fc = fuse_get_conn(iocb->ki_filp); 1979 if (!fc) 1980 return -EPERM; 1981 1982 fuse_copy_init(&cs, fc, 0, iov, nr_segs); 1983 1984 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs)); 1985 } 1986 1987 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, 1988 struct file *out, loff_t *ppos, 1989 size_t len, unsigned int flags) 1990 { 1991 unsigned nbuf; 1992 unsigned idx; 1993 struct pipe_buffer *bufs; 1994 struct fuse_copy_state cs; 1995 struct fuse_conn *fc; 1996 size_t rem; 1997 ssize_t ret; 1998 1999 fc = fuse_get_conn(out); 2000 if (!fc) 2001 return -EPERM; 2002 2003 bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); 2004 if (!bufs) 2005 return -ENOMEM; 2006 2007 pipe_lock(pipe); 2008 nbuf = 0; 2009 rem = 0; 2010 for (idx = 0; idx < pipe->nrbufs && rem < len; idx++) 2011 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len; 2012 2013 ret = -EINVAL; 2014 if (rem < len) { 2015 pipe_unlock(pipe); 2016 goto out; 2017 } 2018 2019 rem = len; 2020 while (rem) { 2021 struct pipe_buffer *ibuf; 2022 struct pipe_buffer *obuf; 2023 2024 BUG_ON(nbuf >= pipe->buffers); 2025 BUG_ON(!pipe->nrbufs); 2026 ibuf = &pipe->bufs[pipe->curbuf]; 2027 obuf = &bufs[nbuf]; 2028 2029 if (rem >= ibuf->len) { 2030 *obuf = *ibuf; 2031 ibuf->ops = NULL; 2032 pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1); 2033 pipe->nrbufs--; 2034 } else { 2035 ibuf->ops->get(pipe, ibuf); 2036 *obuf = *ibuf; 2037 obuf->flags &= ~PIPE_BUF_FLAG_GIFT; 2038 obuf->len = rem; 2039 ibuf->offset += obuf->len; 2040 ibuf->len -= obuf->len; 2041 } 2042 nbuf++; 2043 rem -= obuf->len; 2044 } 2045 pipe_unlock(pipe); 2046 2047 fuse_copy_init(&cs, fc, 0, NULL, nbuf); 2048 cs.pipebufs = bufs; 2049 cs.pipe = pipe; 2050 2051 if (flags & SPLICE_F_MOVE) 2052 cs.move_pages = 1; 2053 2054 ret = fuse_dev_do_write(fc, &cs, len); 2055 2056 for (idx = 0; idx < nbuf; idx++) { 2057 struct pipe_buffer *buf = &bufs[idx]; 2058 buf->ops->release(pipe, buf); 2059 } 2060 out: 2061 kfree(bufs); 2062 return ret; 2063 } 2064 2065 static unsigned fuse_dev_poll(struct file *file, poll_table *wait) 2066 { 2067 unsigned mask = POLLOUT | POLLWRNORM; 2068 struct fuse_conn *fc = fuse_get_conn(file); 2069 if (!fc) 2070 return POLLERR; 2071 2072 poll_wait(file, &fc->waitq, wait); 2073 2074 spin_lock(&fc->lock); 2075 if (!fc->connected) 2076 mask = POLLERR; 2077 else if (request_pending(fc)) 2078 mask |= POLLIN | POLLRDNORM; 2079 spin_unlock(&fc->lock); 2080 2081 return mask; 2082 } 2083 2084 /* 2085 * Abort all requests on the given list (pending or processing) 2086 * 2087 * This function releases and reacquires fc->lock 2088 */ 2089 static void end_requests(struct fuse_conn *fc, struct list_head *head) 2090 __releases(fc->lock) 2091 __acquires(fc->lock) 2092 { 2093 while (!list_empty(head)) { 2094 struct fuse_req *req; 2095 req = list_entry(head->next, struct fuse_req, list); 2096 req->out.h.error = -ECONNABORTED; 2097 request_end(fc, req); 2098 spin_lock(&fc->lock); 2099 } 2100 } 2101 2102 /* 2103 * Abort requests under I/O 2104 * 2105 * The requests are set to aborted and finished, and the request 2106 * waiter is woken up. This will make request_wait_answer() wait 2107 * until the request is unlocked and then return. 2108 * 2109 * If the request is asynchronous, then the end function needs to be 2110 * called after waiting for the request to be unlocked (if it was 2111 * locked). 2112 */ 2113 static void end_io_requests(struct fuse_conn *fc) 2114 __releases(fc->lock) 2115 __acquires(fc->lock) 2116 { 2117 while (!list_empty(&fc->io)) { 2118 struct fuse_req *req = 2119 list_entry(fc->io.next, struct fuse_req, list); 2120 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end; 2121 2122 req->aborted = 1; 2123 req->out.h.error = -ECONNABORTED; 2124 req->state = FUSE_REQ_FINISHED; 2125 list_del_init(&req->list); 2126 wake_up(&req->waitq); 2127 if (end) { 2128 req->end = NULL; 2129 __fuse_get_request(req); 2130 spin_unlock(&fc->lock); 2131 wait_event(req->waitq, !req->locked); 2132 end(fc, req); 2133 fuse_put_request(fc, req); 2134 spin_lock(&fc->lock); 2135 } 2136 } 2137 } 2138 2139 static void end_queued_requests(struct fuse_conn *fc) 2140 __releases(fc->lock) 2141 __acquires(fc->lock) 2142 { 2143 fc->max_background = UINT_MAX; 2144 flush_bg_queue(fc); 2145 end_requests(fc, &fc->pending); 2146 end_requests(fc, &fc->processing); 2147 while (forget_pending(fc)) 2148 kfree(dequeue_forget(fc, 1, NULL)); 2149 } 2150 2151 static void end_polls(struct fuse_conn *fc) 2152 { 2153 struct rb_node *p; 2154 2155 p = rb_first(&fc->polled_files); 2156 2157 while (p) { 2158 struct fuse_file *ff; 2159 ff = rb_entry(p, struct fuse_file, polled_node); 2160 wake_up_interruptible_all(&ff->poll_wait); 2161 2162 p = rb_next(p); 2163 } 2164 } 2165 2166 /* 2167 * Abort all requests. 2168 * 2169 * Emergency exit in case of a malicious or accidental deadlock, or 2170 * just a hung filesystem. 2171 * 2172 * The same effect is usually achievable through killing the 2173 * filesystem daemon and all users of the filesystem. The exception 2174 * is the combination of an asynchronous request and the tricky 2175 * deadlock (see Documentation/filesystems/fuse.txt). 2176 * 2177 * During the aborting, progression of requests from the pending and 2178 * processing lists onto the io list, and progression of new requests 2179 * onto the pending list is prevented by req->connected being false. 2180 * 2181 * Progression of requests under I/O to the processing list is 2182 * prevented by the req->aborted flag being true for these requests. 2183 * For this reason requests on the io list must be aborted first. 2184 */ 2185 void fuse_abort_conn(struct fuse_conn *fc) 2186 { 2187 spin_lock(&fc->lock); 2188 if (fc->connected) { 2189 fc->connected = 0; 2190 fc->blocked = 0; 2191 fuse_set_initialized(fc); 2192 end_io_requests(fc); 2193 end_queued_requests(fc); 2194 end_polls(fc); 2195 wake_up_all(&fc->waitq); 2196 wake_up_all(&fc->blocked_waitq); 2197 kill_fasync(&fc->fasync, SIGIO, POLL_IN); 2198 } 2199 spin_unlock(&fc->lock); 2200 } 2201 EXPORT_SYMBOL_GPL(fuse_abort_conn); 2202 2203 int fuse_dev_release(struct inode *inode, struct file *file) 2204 { 2205 struct fuse_conn *fc = fuse_get_conn(file); 2206 if (fc) { 2207 spin_lock(&fc->lock); 2208 fc->connected = 0; 2209 fc->blocked = 0; 2210 fuse_set_initialized(fc); 2211 end_queued_requests(fc); 2212 end_polls(fc); 2213 wake_up_all(&fc->blocked_waitq); 2214 spin_unlock(&fc->lock); 2215 fuse_conn_put(fc); 2216 } 2217 2218 return 0; 2219 } 2220 EXPORT_SYMBOL_GPL(fuse_dev_release); 2221 2222 static int fuse_dev_fasync(int fd, struct file *file, int on) 2223 { 2224 struct fuse_conn *fc = fuse_get_conn(file); 2225 if (!fc) 2226 return -EPERM; 2227 2228 /* No locking - fasync_helper does its own locking */ 2229 return fasync_helper(fd, file, on, &fc->fasync); 2230 } 2231 2232 const struct file_operations fuse_dev_operations = { 2233 .owner = THIS_MODULE, 2234 .open = fuse_dev_open, 2235 .llseek = no_llseek, 2236 .read = do_sync_read, 2237 .aio_read = fuse_dev_read, 2238 .splice_read = fuse_dev_splice_read, 2239 .write = do_sync_write, 2240 .aio_write = fuse_dev_write, 2241 .splice_write = fuse_dev_splice_write, 2242 .poll = fuse_dev_poll, 2243 .release = fuse_dev_release, 2244 .fasync = fuse_dev_fasync, 2245 }; 2246 EXPORT_SYMBOL_GPL(fuse_dev_operations); 2247 2248 static struct miscdevice fuse_miscdevice = { 2249 .minor = FUSE_MINOR, 2250 .name = "fuse", 2251 .fops = &fuse_dev_operations, 2252 }; 2253 2254 int __init fuse_dev_init(void) 2255 { 2256 int err = -ENOMEM; 2257 fuse_req_cachep = kmem_cache_create("fuse_request", 2258 sizeof(struct fuse_req), 2259 0, 0, NULL); 2260 if (!fuse_req_cachep) 2261 goto out; 2262 2263 err = misc_register(&fuse_miscdevice); 2264 if (err) 2265 goto out_cache_clean; 2266 2267 return 0; 2268 2269 out_cache_clean: 2270 kmem_cache_destroy(fuse_req_cachep); 2271 out: 2272 return err; 2273 } 2274 2275 void fuse_dev_cleanup(void) 2276 { 2277 misc_deregister(&fuse_miscdevice); 2278 kmem_cache_destroy(fuse_req_cachep); 2279 } 2280