releases/4.4.154/fuse-fix-double-request_end.patch

   1 From 87114373ea507895a62afb10d2910bd9adac35a8 Mon Sep 17 00:00:00 2001
   2 From: Miklos Szeredi <mszeredi@redhat.com>
   3 Date: Thu, 26 Jul 2018 16:13:11 +0200
   4 Subject: fuse: fix double request_end()
   5
   6 From: Miklos Szeredi <mszeredi@redhat.com>
   7
   8 commit 87114373ea507895a62afb10d2910bd9adac35a8 upstream.
   9
  10 Refcounting of request is broken when fuse_abort_conn() is called and
  11 request is on the fpq->io list:
  12
  13  - ref is taken too late
  14  - then it is not dropped
  15
  16 Fixes: 0d8e84b0432b ("fuse: simplify request abort")
  17 Cc: <stable@vger.kernel.org> # v4.2
  18 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20
  21 ---
  22  fs/fuse/dev.c |    5 +++--
  23  1 file changed, 3 insertions(+), 2 deletions(-)
  24
  25 --- a/fs/fuse/dev.c
  26 +++ b/fs/fuse/dev.c
  27 @@ -382,7 +382,7 @@ static void request_end(struct fuse_conn
  28         struct fuse_iqueue *fiq = &fc->iq;
  29
  30         if (test_and_set_bit(FR_FINISHED, &req->flags))
  31 -               return;
  32 +               goto out_put_req;
  33
  34         spin_lock(&fiq->waitq.lock);
  35         list_del_init(&req->intr_entry);
  36 @@ -412,6 +412,7 @@ static void request_end(struct fuse_conn
  37         wake_up(&req->waitq);
  38         if (req->end)
  39                 req->end(fc, req);
  40 +out_put_req:
  41         fuse_put_request(fc, req);
  42  }
  43
  44 @@ -2154,6 +2155,7 @@ void fuse_abort_conn(struct fuse_conn *f
  45                                 set_bit(FR_ABORTED, &req->flags);
  46                                 if (!test_bit(FR_LOCKED, &req->flags)) {
  47                                         set_bit(FR_PRIVATE, &req->flags);
  48 +                                       __fuse_get_request(req);
  49                                         list_move(&req->list, &to_end1);
  50                                 }
  51                                 spin_unlock(&req->waitq.lock);
  52 @@ -2180,7 +2182,6 @@ void fuse_abort_conn(struct fuse_conn *f
  53
  54                 while (!list_empty(&to_end1)) {
  55                         req = list_first_entry(&to_end1, struct fuse_req, list);
  56 -                       __fuse_get_request(req);
  57                         list_del_init(&req->list);
  58                         request_end(fc, req);
  59                 }