| From 45ff350bbd9d0f0977ff270a0d427c71520c0c37 Mon Sep 17 00:00:00 2001 |
| From: Miklos Szeredi <mszeredi@redhat.com> |
| Date: Thu, 26 Jul 2018 16:13:11 +0200 |
| Subject: fuse: fix unlocked access to processing queue |
| |
| From: Miklos Szeredi <mszeredi@redhat.com> |
| |
| commit 45ff350bbd9d0f0977ff270a0d427c71520c0c37 upstream. |
| |
| fuse_dev_release() assumes that it's the only one referencing the |
| fpq->processing list, but that's not true, since fuse_abort_conn() can be |
| doing the same without any serialization between the two. |
| |
| Fixes: c3696046beb3 ("fuse: separate pqueue for clones") |
| Cc: <stable@vger.kernel.org> # v4.2 |
| Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/fuse/dev.c | 8 +++++++- |
| 1 file changed, 7 insertions(+), 1 deletion(-) |
| |
| --- a/fs/fuse/dev.c |
| +++ b/fs/fuse/dev.c |
| @@ -2148,9 +2148,15 @@ int fuse_dev_release(struct inode *inode |
| if (fud) { |
| struct fuse_conn *fc = fud->fc; |
| struct fuse_pqueue *fpq = &fud->pq; |
| + LIST_HEAD(to_end); |
| |
| + spin_lock(&fpq->lock); |
| WARN_ON(!list_empty(&fpq->io)); |
| - end_requests(fc, &fpq->processing); |
| + list_splice_init(&fpq->processing, &to_end); |
| + spin_unlock(&fpq->lock); |
| + |
| + end_requests(fc, &to_end); |
| + |
| /* Are we the last open device? */ |
| if (atomic_dec_and_test(&fc->dev_count)) { |
| WARN_ON(fc->iq.fasync != NULL); |
