fuse: fix max i/o size calculation

Fix a bug that Werner Baumann reported: fuse can send a bigger write request
than the maximum specified.  This only affected direct_io operation.

In addition set a sane minimum for the max_read and max_write tunables, so I/O
always makes some progress.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a02418c89d4bbc52a9670d6a91cc2b1e68503a63..2d3649e42599d41eb4a6b7c7e0afaa4cac96e58a 100644 (file)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -966,14 +966,15 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
 
        while (count) {
                size_t nres;
-               size_t nbytes = min(count, nmax);
-               int err = fuse_get_user_pages(req, buf, nbytes, !write);
+               size_t nbytes_limit = min(count, nmax);
+               size_t nbytes;
+               int err = fuse_get_user_pages(req, buf, nbytes_limit, !write);
                if (err) {
                        res = err;
                        break;
                }
                nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
-               nbytes = min(count, nbytes);
+               nbytes = min(nbytes_limit, nbytes);
                if (write)
                        nres = fuse_send_write(req, file, inode, pos, nbytes,
                                               current->files);

diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 7d01c68852a87d17271cf845f7e14e09aaccb22b..0cef5ea319f3dfa03953c48d402ca897f4288e98 100644 (file)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -584,6 +584,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
                fc->minor = arg->minor;
                fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
+               fc->max_write = min_t(unsigned, 4096, fc->max_write);
                fc->conn_init = 1;
        }
        fuse_put_request(fc, req);
@@ -658,7 +659,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
        fc->flags = d.flags;
        fc->user_id = d.user_id;
        fc->group_id = d.group_id;
-       fc->max_read = d.max_read;
+       fc->max_read = min_t(unsigned, 4096, d.max_read);
 
        /* Used by get_root_inode() */
        sb->s_fs_info = fc;