queue-4.14/fuse-fix-possibly-missed-wake-up-after-abort.patch

   1 From 7345fc3d0e29b521060d471c9fb2610a4e2c1bde Mon Sep 17 00:00:00 2001
   2 From: Miklos Szeredi <mszeredi@redhat.com>
   3 Date: Fri, 9 Nov 2018 15:52:16 +0100
   4 Subject: fuse: fix possibly missed wake-up after abort
   5
   6 [ Upstream commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 ]
   7
   8 In current fuse_drop_waiting() implementation it's possible that
   9 fuse_wait_aborted() will not be woken up in the unlikely case that
  10 fuse_abort_conn() + fuse_wait_aborted() runs in between checking
  11 fc->connected and calling atomic_dec(&fc->num_waiting).
  12
  13 Do the atomic_dec_and_test() unconditionally, which also provides the
  14 necessary barrier against reordering with the fc->connected check.
  15
  16 The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since
  17 the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE
  18 barrier after resetting fc->connected.  However, this is not a performance
  19 sensitive path, and adding the explicit barrier makes it easier to
  20 document.
  21
  22 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  23 Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests")
  24 Cc: <stable@vger.kernel.org> #v4.19
  25 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  26 ---
  27  fs/fuse/dev.c | 12 +++++++++---
  28  1 file changed, 9 insertions(+), 3 deletions(-)
  29
  30 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
  31 index 770733106d6d4..c934fab444529 100644
  32 --- a/fs/fuse/dev.c
  33 +++ b/fs/fuse/dev.c
  34 @@ -133,9 +133,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
  35
  36  static void fuse_drop_waiting(struct fuse_conn *fc)
  37  {
  38 -       if (fc->connected) {
  39 -               atomic_dec(&fc->num_waiting);
  40 -       } else if (atomic_dec_and_test(&fc->num_waiting)) {
  41 +       /*
  42 +        * lockess check of fc->connected is okay, because atomic_dec_and_test()
  43 +        * provides a memory barrier mached with the one in fuse_wait_aborted()
  44 +        * to ensure no wake-up is missed.
  45 +        */
  46 +       if (atomic_dec_and_test(&fc->num_waiting) &&
  47 +           !READ_ONCE(fc->connected)) {
  48                 /* wake up aborters */
  49                 wake_up_all(&fc->blocked_waitq);
  50         }
  51 @@ -2170,6 +2174,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
  52
  53  void fuse_wait_aborted(struct fuse_conn *fc)
  54  {
  55 +       /* matches implicit memory barrier in fuse_drop_waiting() */
  56 +       smp_mb();
  57         wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
  58  }
  59
  60 --
  61 2.20.1
  62