]> git.karo-electronics.de Git - linux-beck.git/commit
fuse: clear FR_PENDING flag when moving requests out of pending queue
authorTahsin Erdogan <tahsin@google.com>
Thu, 12 Jan 2017 20:04:04 +0000 (12:04 -0800)
committerMiklos Szeredi <mszeredi@redhat.com>
Fri, 13 Jan 2017 11:03:47 +0000 (12:03 +0100)
commita8a86d78d673b1c99fe9b0064739fde9e9774184
tree12aaf53834805de16bf1cb6af09aa107695babde
parenta121103c922847ba5010819a3f250f1f7fc84ab8
fuse: clear FR_PENDING flag when moving requests out of pending queue

fuse_abort_conn() moves requests from pending list to a temporary list
before canceling them. This operation races with request_wait_answer()
which also tries to remove the request after it gets a fatal signal. It
checks FR_PENDING flag to determine whether the request is still in the
pending list.

Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
does not remove the request from temporary list.

This bug causes an Oops when trying to delete an already deleted list entry
in end_requests().

Fixes: ee314a870e40 ("fuse: abort: no fc->lock needed for request ending")
Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org> # 4.2+
fs/fuse/dev.c