[PATCH kernel-4.19 1/2] fuse: truncate pagecache on atomic_o_trunc
From: Miklos Szeredi <mszeredi@redhat.com> mainline inclusion from mainline-5.14 commit 76224355db7570cbe6b6f75c8929a1558828dd55 category: bugfix bugzilla: 181107 CVE: NA --------------------------- fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in fuse_launder_page() triggered by invalidate_inode_pages2(). Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE or fc->writeback cache, so do it unconditionally. Reported-by: Xie Yongji <xieyongji@bytedance.com> Reported-and-tested-by: syzbot+bea44a5189836d956894@syzkaller.appspotmail.com Fixes: e4648309b85a ("fuse: truncate pending writes on O_TRUNC") Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Conflict: fs/fuse/file.c Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Zhang Yi <yi.zhang@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- fs/fuse/file.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 41e2a7b567d7f..5ecabacabd477 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -178,8 +178,6 @@ void fuse_finish_open(struct inode *inode, struct file *file) if (ff->open_flags & FOPEN_DIRECT_IO) file->f_op = &fuse_direct_io_file_operations; - if (!(ff->open_flags & FOPEN_KEEP_CACHE)) - invalidate_inode_pages2(inode->i_mapping); if (ff->open_flags & FOPEN_STREAM) stream_open(inode, file); else if (ff->open_flags & FOPEN_NONSEEKABLE) @@ -191,10 +189,13 @@ void fuse_finish_open(struct inode *inode, struct file *file) fi->attr_version = ++fc->attr_version; i_size_write(inode, 0); spin_unlock(&fc->lock); + truncate_pagecache(inode, 0); fuse_invalidate_attr(inode); if (fc->writeback_cache) file_update_time(file); - } + } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) + invalidate_inode_pages2(inode->i_mapping); + if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache) fuse_link_write_file(file); } -- 2.25.1
From: Miklos Szeredi <mszeredi@redhat.com> mainline inclusion from mainline-5.14-rc1 commit b89ecd60d38ec042d63bdb376c722a16f92bcb88 category: bugfix bugzilla: 182370 CVE: NA --------------------------- Fix the "fuse: trying to steal weird page" warning. Description from Johannes Weiner: "Think of it as similar to PG_active. It's just another usage/heat indicator of file and anon pages on the reclaim LRU that, unlike PG_active, persists across deactivation and even reclaim (we store it in the page cache / swapper cache tree until the page refaults). So if fuse accepts pages that can legally have PG_active set, PG_workingset is fine too." Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com> Fixes: 1899ad18c607 ("mm: workingset: tell cache transitions from workingset thrashing") Cc: <stable@vger.kernel.org> # v4.20 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Conflicts: fs/fuse/dev.c Signed-off-by: yangerkun <yangerkun@huawei.com> Reviewed-by: Zhang Yi <yi.zhang@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- fs/fuse/dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8b22f8705dd48..96dd24816f12b 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -837,6 +837,7 @@ static int fuse_check_page(struct page *page) 1 << PG_uptodate | 1 << PG_lru | 1 << PG_active | + 1 << PG_workingset | 1 << PG_reclaim | 1 << PG_waiters))) { printk(KERN_WARNING "fuse: trying to steal weird page\n"); -- 2.25.1
participants (1)
-
Yang Yingliang