diff options
Diffstat (limited to 'fs/fuse')
| -rw-r--r-- | fs/fuse/dev.c | 14 | ||||
| -rw-r--r-- | fs/fuse/dir.c | 2 |
2 files changed, 13 insertions, 3 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index b6f2a10663a0..db7d746633cf 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -902,6 +902,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) if (!(buf->flags & PIPE_BUF_FLAG_LRU)) lru_cache_add_file(newpage); + /* + * Release while we have extra ref on stolen page. Otherwise + * anon_pipe_buf_release() might think the page can be reused. + */ + pipe_buf_release(cs->pipe, buf); + err = 0; spin_lock(&cs->req->waitq.lock); if (test_bit(FR_ABORTED, &cs->req->flags)) @@ -2046,8 +2052,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, pipe_lock(pipe); out_free: - for (idx = 0; idx < nbuf; idx++) - pipe_buf_release(pipe, &bufs[idx]); + for (idx = 0; idx < nbuf; idx++) { + struct pipe_buffer *buf = &bufs[idx]; + + if (buf->ops) + pipe_buf_release(pipe, buf); + } pipe_unlock(pipe); kfree(bufs); diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 4d95a416fc36..b8d13b69583c 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -969,7 +969,7 @@ int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid, if (!parent) return -ENOENT; - inode_lock(parent); + inode_lock_nested(parent, I_MUTEX_PARENT); if (!S_ISDIR(parent->i_mode)) goto unlock; |