Fuse didn't always call i_size_write() with i_mutex held which caused
rare hangs on SMP/32bit. This bug has been present since fuse-2.2,
well before being merged into mainline.
The simplest solution is to protect i_size_write() with the
per-connection spinlock. Using i_mutex for this purpose would require
some restructuring of the code and I'm not even sure it's always safe
to acquire i_mutex in all places i_size needs to be set.
Since most of vmtruncate is already duplicated for other reasons,
duplicate the remaining part as well, making all i_size_write() calls
internal to fuse.
Using i_size_write() was unnecessary in fuse_init_inode(), since this
function is only called on a newly created locked inode.
Reported by a few people over the years, but special thanks to Dana
Henriksen who was persistent enough in helping me debug it.
Signed-off-by: Miklos Szeredi <[email protected]>
---
Index: linux/fs/fuse/dir.c
===================================================================
--- linux.orig/fs/fuse/dir.c 2006-10-16 15:56:10.000000000 +0200
+++ linux/fs/fuse/dir.c 2006-10-16 16:06:11.000000000 +0200
@@ -935,14 +935,30 @@ static void iattr_to_fattr(struct iattr
}
}
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ int need_trunc;
+
+ spin_lock(&fc->lock);
+ need_trunc = inode->i_size > offset;
+ i_size_write(inode, offset);
+ spin_unlock(&fc->lock);
+
+ if (need_trunc) {
+ struct address_space *mapping = inode->i_mapping;
+ unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+ truncate_inode_pages(mapping, offset);
+ }
+}
+
/*
* Set attributes, and at the same time refresh them.
*
* Truncation is slightly complicated, because the 'truncate' request
* may fail, in which case we don't want to touch the mapping.
- * vmtruncate() doesn't allow for this case. So do the rlimit
- * checking by hand and call vmtruncate() only after the file has
- * actually been truncated.
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
*/
static int fuse_setattr(struct dentry *entry, struct iattr *attr)
{
@@ -993,12 +1009,8 @@ static int fuse_setattr(struct dentry *e
make_bad_inode(inode);
err = -EIO;
} else {
- if (is_truncate) {
- loff_t origsize = i_size_read(inode);
- i_size_write(inode, outarg.attr.size);
- if (origsize > outarg.attr.size)
- vmtruncate(inode, outarg.attr.size);
- }
+ if (is_truncate)
+ fuse_vmtruncate(inode, outarg.attr.size);
fuse_change_attributes(inode, &outarg.attr);
fi->i_time = time_to_jiffies(outarg.attr_valid,
outarg.attr_valid_nsec);
Index: linux/fs/fuse/file.c
===================================================================
--- linux.orig/fs/fuse/file.c 2006-10-16 15:56:10.000000000 +0200
+++ linux/fs/fuse/file.c 2006-10-16 15:58:45.000000000 +0200
@@ -481,8 +481,10 @@ static int fuse_commit_write(struct file
err = -EIO;
if (!err) {
pos += count;
- if (pos > i_size_read(inode))
+ spin_lock(&fc->lock);
+ if (pos > inode->i_size)
i_size_write(inode, pos);
+ spin_unlock(&fc->lock);
if (offset == 0 && to == PAGE_CACHE_SIZE) {
clear_page_dirty(page);
@@ -586,8 +588,12 @@ static ssize_t fuse_direct_io(struct fil
}
fuse_put_request(fc, req);
if (res > 0) {
- if (write && pos > i_size_read(inode))
- i_size_write(inode, pos);
+ if (write) {
+ spin_lock(&fc->lock);
+ if (pos > inode->i_size)
+ i_size_write(inode, pos);
+ spin_unlock(&fc->lock);
+ }
*ppos = pos;
}
fuse_invalidate_attr(inode);
Index: linux/fs/fuse/inode.c
===================================================================
--- linux.orig/fs/fuse/inode.c 2006-10-16 15:56:10.000000000 +0200
+++ linux/fs/fuse/inode.c 2006-10-16 15:57:12.000000000 +0200
@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_
void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
{
+ struct fuse_conn *fc = get_fuse_conn(inode);
if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size)
invalidate_inode_pages(inode->i_mapping);
@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode
inode->i_nlink = attr->nlink;
inode->i_uid = attr->uid;
inode->i_gid = attr->gid;
+ spin_lock(&fc->lock);
i_size_write(inode, attr->size);
+ spin_unlock(&fc->lock);
inode->i_blocks = attr->blocks;
inode->i_atime.tv_sec = attr->atime;
inode->i_atime.tv_nsec = attr->atimensec;
@@ -130,7 +133,7 @@ void fuse_change_attributes(struct inode
static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
{
inode->i_mode = attr->mode & S_IFMT;
- i_size_write(inode, attr->size);
+ inode->i_size = attr->size;
if (S_ISREG(inode->i_mode)) {
fuse_init_common(inode);
fuse_init_file_inode(inode);
--
On Mon, 16 Oct 2006 18:27:10 +0200
Miklos Szeredi <[email protected]> wrote:
> Fuse didn't always call i_size_write() with i_mutex held which caused
> rare hangs on SMP/32bit.
Yes, that is a bit of a trap. I'll maintain a patch in -mm which spits a
warning if i_size_write() is called without i_mutex held.
--- a/include/linux/fs.h~mm-only-i_size_write-debugging
+++ a/include/linux/fs.h
@@ -646,25 +646,7 @@ static inline loff_t i_size_read(struct
#endif
}
-/*
- * NOTE: unlike i_size_read(), i_size_write() does need locking around it
- * (normally i_mutex), otherwise on 32bit/SMP an update of i_size_seqcount
- * can be lost, resulting in subsequent i_size_read() calls spinning forever.
- */
-static inline void i_size_write(struct inode *inode, loff_t i_size)
-{
-#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
- write_seqcount_begin(&inode->i_size_seqcount);
- inode->i_size = i_size;
- write_seqcount_end(&inode->i_size_seqcount);
-#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPT)
- preempt_disable();
- inode->i_size = i_size;
- preempt_enable();
-#else
- inode->i_size = i_size;
-#endif
-}
+void i_size_write(struct inode *inode, loff_t i_size);
static inline unsigned iminor(struct inode *inode)
{
diff -puN fs/inode.c~mm-only-i_size_write-debugging fs/inode.c
--- a/fs/inode.c~mm-only-i_size_write-debugging
+++ a/fs/inode.c
@@ -1384,6 +1384,23 @@ void __init inode_init(unsigned long mem
INIT_HLIST_HEAD(&inode_hashtable[loop]);
}
+void i_size_write(struct inode *inode, loff_t i_size)
+{
+ WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
+#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
+ write_seqcount_begin(&inode->i_size_seqcount);
+ inode->i_size = i_size;
+ write_seqcount_end(&inode->i_size_seqcount);
+#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPT)
+ preempt_disable();
+ inode->i_size = i_size;
+ preempt_enable();
+#else
+ inode->i_size = i_size;
+#endif
+}
+EXPORT_SYMBOL(i_size_write);
+
void init_special_inode(struct inode *inode, umode_t mode, dev_t rdev)
{
inode->i_mode = mode;
_
On 16/10/06 16:51 -0700, Andrew Morton wrote:
>On Mon, 16 Oct 2006 18:27:10 +0200
>Miklos Szeredi <[email protected]> wrote:
>
>> Fuse didn't always call i_size_write() with i_mutex held which caused
>> rare hangs on SMP/32bit.
>
>Yes, that is a bit of a trap. I'll maintain a patch in -mm which spits a
>warning if i_size_write() is called without i_mutex held.
>
>+void i_size_write(struct inode *inode, loff_t i_size)
>+{
>+ WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
Miklos' patch would generate this warning because he uses the spinlock
inside struct fuse_conn to synchronize the write:
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ int need_trunc;
+
+ spin_lock(&fc->lock);
+ need_trunc = inode->i_size > offset;
+ i_size_write(inode, offset);
+ spin_unlock(&fc->lock);
--
Mike D. Day
IBM LTC
Cell: 919 412-3900
Sametime: [email protected] AIM: ncmikeday Yahoo: ultra.runner
PGP key: http://www.ncultra.org/ncmike/pubkey.asc
> On 16/10/06 16:51 -0700, Andrew Morton wrote:
> >On Mon, 16 Oct 2006 18:27:10 +0200
> >Miklos Szeredi <[email protected]> wrote:
> >
> >> Fuse didn't always call i_size_write() with i_mutex held which caused
> >> rare hangs on SMP/32bit.
> >
> >Yes, that is a bit of a trap. I'll maintain a patch in -mm which spits a
> >warning if i_size_write() is called without i_mutex held.
> >
>
> >+void i_size_write(struct inode *inode, loff_t i_size)
> >+{
> >+ WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
>
>
> Miklos' patch would generate this warning because he uses the spinlock
> inside struct fuse_conn to synchronize the write:
Yes, this will cause a false alarm for FUSE, but it may still be
useful to find similar bugs in other filesystems.
Miklos