diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 9eb191b5c4de..7dd7b244951b 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -331,6 +331,69 @@ void fuse_request_end(struct fuse_req *req)
 }
 EXPORT_SYMBOL_GPL(fuse_request_end);
 
+/* fuse_request_end for requests that timeout */
+static void fuse_request_timeout(struct fuse_req *req)
+{
+	struct fuse_conn *fc = req->fm->fc;
+	struct fuse_iqueue *fiq = &fc->iq;
+	struct fuse_pqueue *fpq;
+
+	spin_lock(&fiq->lock);
+	if (!fiq->connected) {
+		spin_unlock(&fiq->lock);
+		/*
+		 * Connection is being aborted. The abort will release
+		 * the refcount on the request
+		 */
+		req->out.h.error = -ECONNABORTED;
+		return;
+	}
+	if (test_bit(FR_PENDING, &req->flags)) {
+		/* Request is not yet in userspace, bail out */
+		list_del(&req->list);
+		spin_unlock(&fiq->lock);
+		req->out.h.error = -ETIME;
+		__fuse_put_request(req);
+		return;
+	}
+	if (test_bit(FR_INTERRUPTED, &req->flags))
+		list_del_init(&req->intr_entry);
+
+	fpq = req->fpq;
+	spin_unlock(&fiq->lock);
+
+	if (fpq) {
+		spin_lock(&fpq->lock);
+		if (!fpq->connected && (!test_bit(FR_PRIVATE, &req->flags))) {
+			spin_unlock(&fpq->lock);
+			/*
+			 * Connection is being aborted. The abort will release
+			 * the refcount on the request
+			 */
+			req->out.h.error = -ECONNABORTED;
+			return;
+		}
+		if (req->out.h.error == -ESTALE) {
+			/*
+			 * Device is being released. The fuse_dev_release call
+			 * will drop the refcount on the request
+			 */
+			spin_unlock(&fpq->lock);
+			return;
+		}
+		if (!test_bit(FR_PRIVATE, &req->flags))
+			list_del_init(&req->list);
+		spin_unlock(&fpq->lock);
+	}
+
+	req->out.h.error = -ETIME;
+
+	if (test_bit(FR_ASYNC, &req->flags))
+		req->args->end(req->fm, req->args, req->out.h.error);
+
+	fuse_put_request(req);
+}
+
 static int queue_interrupt(struct fuse_req *req)
 {
 	struct fuse_iqueue *fiq = &req->fm->fc->iq;
@@ -361,6 +424,62 @@ static int queue_interrupt(struct fuse_req *req)
 	return 0;
 }
 
+enum wait_type {
+	WAIT_TYPE_INTERRUPTIBLE,
+	WAIT_TYPE_KILLABLE,
+	WAIT_TYPE_NONINTERRUPTIBLE,
+};
+
+static int fuse_wait_event_interruptible_timeout(struct fuse_req *req)
+{
+	struct fuse_conn *fc = req->fm->fc;
+
+	return wait_event_interruptible_timeout(req->waitq,
+						test_bit(FR_FINISHED,
+							 &req->flags),
+						fc->daemon_timeout);
+}
+ALLOW_ERROR_INJECTION(fuse_wait_event_interruptible_timeout, ERRNO);
+
+static int wait_answer_timeout(struct fuse_req *req, enum wait_type type)
+{
+	struct fuse_conn *fc = req->fm->fc;
+	int err;
+
+wait_answer_start:
+	if (type == WAIT_TYPE_INTERRUPTIBLE)
+		err = fuse_wait_event_interruptible_timeout(req);
+	else if (type == WAIT_TYPE_KILLABLE)
+		err = wait_event_killable_timeout(req->waitq,
+						  test_bit(FR_FINISHED, &req->flags),
+						  fc->daemon_timeout);
+
+	else if (type == WAIT_TYPE_NONINTERRUPTIBLE)
+		err = wait_event_timeout(req->waitq, test_bit(FR_FINISHED, &req->flags),
+					 fc->daemon_timeout);
+	else
+		WARN_ON(1);
+
+	/* request was answered */
+	if (err > 0)
+		return 0;
+
+	/* request was not answered in time */
+	if (err == 0) {
+		if (test_and_set_bit(FR_PROCESSING, &req->flags))
+			/* request reply is being processed by kernel right now.
+			 * we should wait for the answer.
+			 */
+			goto wait_answer_start;
+
+		fuse_request_timeout(req);
+		return 0;
+	}
+
+	/* else request was interrupted */
+	return err;
+}
+
 static void request_wait_answer(struct fuse_req *req)
 {
 	struct fuse_conn *fc = req->fm->fc;
@@ -369,8 +488,11 @@ static void request_wait_answer(struct fuse_req *req)
 
 	if (!fc->no_interrupt) {
 		/* Any signal may interrupt this */
-		err = wait_event_interruptible(req->waitq,
-					test_bit(FR_FINISHED, &req->flags));
+		if (fc->daemon_timeout)
+			err = wait_answer_timeout(req, WAIT_TYPE_INTERRUPTIBLE);
+		else
+			err = wait_event_interruptible(req->waitq,
+						       test_bit(FR_FINISHED, &req->flags));
 		if (!err)
 			return;
 
@@ -383,8 +505,11 @@ static void request_wait_answer(struct fuse_req *req)
 
 	if (!test_bit(FR_FORCE, &req->flags)) {
 		/* Only fatal signals may interrupt this */
-		err = wait_event_killable(req->waitq,
-					test_bit(FR_FINISHED, &req->flags));
+		if (fc->daemon_timeout)
+			err = wait_answer_timeout(req, WAIT_TYPE_KILLABLE);
+		else
+			err = wait_event_killable(req->waitq,
+						  test_bit(FR_FINISHED, &req->flags));
 		if (!err)
 			return;
 
@@ -404,7 +529,10 @@ static void request_wait_answer(struct fuse_req *req)
 	 * Either request is already in userspace, or it was forced.
 	 * Wait it out.
 	 */
-	wait_event(req->waitq, test_bit(FR_FINISHED, &req->flags));
+	if (fc->daemon_timeout)
+		wait_answer_timeout(req, WAIT_TYPE_NONINTERRUPTIBLE);
+	else
+		wait_event(req->waitq, test_bit(FR_FINISHED, &req->flags));
 }
 
 static void __fuse_request_send(struct fuse_req *req)
@@ -1268,6 +1396,9 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 	req = list_entry(fiq->pending.next, struct fuse_req, list);
 	clear_bit(FR_PENDING, &req->flags);
 	list_del_init(&req->list);
+	/* Acquire a reference since fuse_request_timeout may also be executing  */
+	__fuse_get_request(req);
+	req->fpq = fpq;
 	spin_unlock(&fiq->lock);
 
 	args = req->args;
@@ -1280,6 +1411,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 		if (args->opcode == FUSE_SETXATTR)
 			req->out.h.error = -E2BIG;
 		fuse_request_end(req);
+		fuse_put_request(req);
 		goto restart;
 	}
 	spin_lock(&fpq->lock);
@@ -1316,13 +1448,23 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 	}
 	hash = fuse_req_hash(req->in.h.unique);
 	list_move_tail(&req->list, &fpq->processing[hash]);
-	__fuse_get_request(req);
 	set_bit(FR_SENT, &req->flags);
 	spin_unlock(&fpq->lock);
 	/* matches barrier in request_wait_answer() */
 	smp_mb__after_atomic();
 	if (test_bit(FR_INTERRUPTED, &req->flags))
 		queue_interrupt(req);
+
+	/* Check if request timed out */
+	if (test_bit(FR_PROCESSING, &req->flags)) {
+		spin_lock(&fpq->lock);
+		if (!test_bit(FR_PRIVATE, &req->flags))
+			list_del_init(&req->list);
+		spin_unlock(&fpq->lock);
+		fuse_put_request(req);
+		return -ETIME;
+	}
+
 	fuse_put_request(req);
 
 	return reqsize;
@@ -1332,6 +1474,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 		list_del_init(&req->list);
 	spin_unlock(&fpq->lock);
 	fuse_request_end(req);
+	fuse_put_request(req);
 	return err;
 
  err_unlock:
@@ -1951,9 +2094,10 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
 		goto copy_finish;
 	}
 
+	__fuse_get_request(req);
+
 	/* Is it an interrupt reply ID? */
 	if (oh.unique & FUSE_INT_REQ_BIT) {
-		__fuse_get_request(req);
 		spin_unlock(&fpq->lock);
 
 		err = 0;
@@ -1969,6 +2113,13 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
 		goto copy_finish;
 	}
 
+	if (test_and_set_bit(FR_PROCESSING, &req->flags)) {
+		/* request has timed out already */
+		spin_unlock(&fpq->lock);
+		fuse_put_request(req);
+		goto copy_finish;
+	}
+
 	clear_bit(FR_SENT, &req->flags);
 	list_move(&req->list, &fpq->io);
 	req->out.h = oh;
@@ -1995,6 +2146,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
 	spin_unlock(&fpq->lock);
 
 	fuse_request_end(req);
+	fuse_put_request(req);
 out:
 	return err ? err : nbytes;
 
@@ -2260,13 +2412,22 @@ int fuse_dev_release(struct inode *inode, struct file *file)
 	if (fud) {
 		struct fuse_conn *fc = fud->fc;
 		struct fuse_pqueue *fpq = &fud->pq;
+		struct fuse_req *req;
 		LIST_HEAD(to_end);
 		unsigned int i;
 
 		spin_lock(&fpq->lock);
 		WARN_ON(!list_empty(&fpq->io));
-		for (i = 0; i < FUSE_PQ_HASH_SIZE; i++)
+		for (i = 0; i < FUSE_PQ_HASH_SIZE; i++) {
+			/*
+			 * Set the req error to -ESTALE so that if the timeout
+			 * handler tries handling it, it knows it's being
+			 * released
+			 */
+			list_for_each_entry(req, &fpq->processing[i], list)
+				req->out.h.error = -ESTALE;
 			list_splice_init(&fpq->processing[i], &to_end);
+		}
 		spin_unlock(&fpq->lock);
 
 		end_requests(&to_end);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index f23919610313..cbabebbcd5bd 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -375,6 +375,9 @@ struct fuse_io_priv {
  * FR_FINISHED:		request is finished
  * FR_PRIVATE:		request is on private list
  * FR_ASYNC:		request is asynchronous
+ * FR_PROCESSING:	request is being processed. this gets set when either
+ *			the reply is getting processed or the kernel is processing
+ *			a request timeout
  */
 enum fuse_req_flag {
 	FR_ISREPLY,
@@ -389,6 +392,7 @@ enum fuse_req_flag {
 	FR_FINISHED,
 	FR_PRIVATE,
 	FR_ASYNC,
+	FR_PROCESSING,
 };
 
 /**
@@ -435,6 +439,9 @@ struct fuse_req {
 
 	/** fuse_mount this request belongs to */
 	struct fuse_mount *fm;
+
+	/** page queue this request has been added to */
+	struct fuse_pqueue *fpq;
 };
 
 struct fuse_iqueue;
@@ -574,6 +581,8 @@ struct fuse_fs_context {
 	enum fuse_dax_mode dax_mode;
 	unsigned int max_read;
 	unsigned int blksize;
+	/*  Daemon timeout (in seconds). 0 = no timeout (infinite wait) */
+	unsigned int daemon_timeout;
 	const char *subtype;
 
 	/* DAX device, may be NULL */
@@ -633,6 +642,9 @@ struct fuse_conn {
 	/** Constrain ->max_pages to this value during feature negotiation */
 	unsigned int max_pages_limit;
 
+	/* Daemon timeout (in jiffies). 0 = no timeout (infinite wait) */
+	unsigned long daemon_timeout;
+
 	/** Input queue */
 	struct fuse_iqueue iq;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 99e44ea7d875..a2d53a8b8e34 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -733,6 +733,7 @@ enum {
 	OPT_ALLOW_OTHER,
 	OPT_MAX_READ,
 	OPT_BLKSIZE,
+	OPT_DAEMON_TIMEOUT,
 	OPT_ERR
 };
 
@@ -747,6 +748,7 @@ static const struct fs_parameter_spec fuse_fs_parameters[] = {
 	fsparam_u32	("max_read",		OPT_MAX_READ),
 	fsparam_u32	("blksize",		OPT_BLKSIZE),
 	fsparam_string	("subtype",		OPT_SUBTYPE),
+	fsparam_u32	("daemon_timeout",	OPT_DAEMON_TIMEOUT),
 	{}
 };
 
@@ -830,6 +832,10 @@ static int fuse_parse_param(struct fs_context *fsc, struct fs_parameter *param)
 		ctx->blksize = result.uint_32;
 		break;
 
+	case OPT_DAEMON_TIMEOUT:
+		ctx->daemon_timeout = result.uint_32;
+		break;
+
 	default:
 		return -EINVAL;
 	}
@@ -1724,6 +1730,7 @@ int fuse_fill_super_common(struct super_block *sb, struct fuse_fs_context *ctx)
 	fc->group_id = ctx->group_id;
 	fc->legacy_opts_show = ctx->legacy_opts_show;
 	fc->max_read = max_t(unsigned int, 4096, ctx->max_read);
+	fc->daemon_timeout = ctx->daemon_timeout * HZ;
 	fc->destroy = ctx->destroy;
 	fc->no_control = ctx->no_control;
 	fc->no_force_umount = ctx->no_force_umount;
