[Devel] [PATCH RHEL7 COMMIT] fuse: fuse_send_writepage() must check FUSE_S_FAIL_IMMEDIATELY

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.36.1.vz7.20.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.36.1.vz7.20.12
------>
commit d9db74f4ea93d48aebf0f3f298ff7da1e92d4e5b
Author: Maxim Patlasov <mpatlasov at virtuozzo.com>
Date:   Thu Dec 8 19:01:07 2016 +0400

    fuse: fuse_send_writepage() must check FUSE_S_FAIL_IMMEDIATELY
    
    The patch fixes the following race (leading to deadlock):
    
    1. Thread A. Enter fuse_prepare_write() checks for FUSE_S_FAIL_IMMEDIATELY,
    but it was not set yet, so it doesn't return -EIO.
    
    2. Thread B. Enter fuse_invalidate_files(). It sets FUSE_S_FAIL_IMMEDIATELY,
    calls filemap_write_and_wait() and fuse_kill_requests(), then release
    fc->lock.
    
    3. Thread A. fuse_commit_write() marks page as "Dirty", then
    fuse_write_end() unlocks the page.
    
    4. Thread B. fuse_invalidate_files() calls invalidate_inode_pages2(). The
    page is dirty, so it ends up in fuse_launder_page() calling
    fuse_writepage_locked(). The latter successfully proceeds queuing
    fuse-write-back request, but then fuse_launder_page() calls
    fuse_wait_on_page_writeback() that blocks forever because Thread A is still
    blocked in fuse_invalidate_files().
    
    Signed-off-by: Maxim Patlasov <mpatlasov at virtuozzo.com>
---
 fs/fuse/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 641b570..a14c929 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1875,7 +1875,8 @@ __acquires(fc->lock)
 	struct fuse_write_in *inarg = &req->misc.write.in;
 	__u64 data_size = req->num_pages * PAGE_CACHE_SIZE;
 
-	if (!fc->connected)
+	if (!fc->connected ||
+	    test_bit(FUSE_S_FAIL_IMMEDIATELY, &req->ff->ff_state))
 		goto out_free;
 
 	if (inarg->offset + data_size <= size) {