Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8a86d78 authored by Tahsin Erdogan's avatar Tahsin Erdogan Committed by Miklos Szeredi
Browse files

fuse: clear FR_PENDING flag when moving requests out of pending queue 



fuse_abort_conn() moves requests from pending list to a temporary list
before canceling them. This operation races with request_wait_answer()
which also tries to remove the request after it gets a fatal signal. It
checks FR_PENDING flag to determine whether the request is still in the
pending list.

Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
does not remove the request from temporary list.

This bug causes an Oops when trying to delete an already deleted list entry
in end_requests().

Fixes: ee314a87 ("fuse: abort: no fc->lock needed for request ending")
Signed-off-by: default avatarTahsin Erdogan <tahsin@google.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org> # 4.2+
parent a121103c

fs/fuse/dev.c

+2 −1
Original line number Diff line number Diff line
@@ -2025,7 +2025,6 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head) 
		struct fuse_req *req;

		req = list_entry(head->next, struct fuse_req, list);

		req->out.h.error = -ECONNABORTED;

		clear_bit(FR_PENDING, &req->flags);

		clear_bit(FR_SENT, &req->flags);

		list_del_init(&req->list);

		request_end(fc, req);
@@ -2103,6 +2102,8 @@ void fuse_abort_conn(struct fuse_conn *fc) 
		spin_lock(&fiq->waitq.lock);

		fiq->connected = 0;

		list_splice_init(&fiq->pending, &to_end2);

		list_for_each_entry(req, &to_end2, list)

			clear_bit(FR_PENDING, &req->flags);

		while (forget_pending(fiq))

			kfree(dequeue_forget(fiq, 1, NULL));

		wake_up_all_locked(&fiq->waitq);