fuse-uring: fix moving cancelled entry to ent_in_userspace list

fuse_uring_cancel() moves entries that are available (these have no reqs
attached) to the ent_in_userspace list. ent_list_request_expired()
checks the first entry on ent_in_userspace and dereferences
ent->fuse_req unconditionally, which will crash on a cancelled entry
that was moved to this list.

Fix this by freeing the entry and dropping queue_refs directly in
fuse_uring_cancel(). This is safe because cancel is the cancel handler
itself - after io_uring_cmd_done(), no more cancels will be dispatched
for this command, and teardown serializes with cancel via queue->lock.

Since cancel now decrements queue_refs, fuse_uring_abort() must no
longer gate fuse_uring_abort_end_requests() on queue_refs > 0, as
cancelled entries may have already dropped queue_refs while requests are
still queued. Remove the gate so abort always flushes requests and stops
queues.

Reported-by: Heechan Kang <gganji11@naver.com>
Tested-by: Heechan Kang <gganji11@naver.com>
Reviewed-by: Bernd Schubert <bernd@bsbernd.com>
Fixes: 4fea593e625c ("fuse: optimize over-io-uring request expiration check")
Cc: stable@vger.kernel.org
Suggested-by: Jian Huang Li <ali@ddn.com>
Suggested-by: Horst Birthelmer <horst@birthelmer.de>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c
index fb24a2cb53dcce909132719dd7314c06f931580c..0bda31f76c7f0b0979b82d516b5932e19e807c5a 100644 (file)
--- a/fs/fuse/dev_uring.c
+++ b/fs/fuse/dev_uring.c
@@ -511,8 +511,7 @@ static void fuse_uring_cancel(struct io_uring_cmd *cmd,
        queue = ent->queue;
        spin_lock(&queue->lock);
        if (ent->state == FRRS_AVAILABLE) {
-               ent->state = FRRS_USERSPACE;
-               list_move_tail(&ent->list, &queue->ent_in_userspace);
+               list_del_init(&ent->list);
                need_cmd_done = true;
                ent->cmd = NULL;
        }
@@ -521,6 +520,9 @@ static void fuse_uring_cancel(struct io_uring_cmd *cmd,
        if (need_cmd_done) {
                /* no queue lock to avoid lock order issues */
                io_uring_cmd_done(cmd, -ENOTCONN, issue_flags);
+               kfree(ent);
+               if (atomic_dec_and_test(&queue->ring->queue_refs))
+                       wake_up_all(&queue->ring->stop_waitq);
        }
 }
 

diff --git a/fs/fuse/dev_uring_i.h b/fs/fuse/dev_uring_i.h
index 531233e03e5466e1aa3f40658fcd9f8988df9cff..054ad4fdd7491d2858f23a455cd14ca8d81fa16a 100644 (file)
--- a/fs/fuse/dev_uring_i.h
+++ b/fs/fuse/dev_uring_i.h
@@ -152,10 +152,10 @@ static inline void fuse_uring_abort(struct fuse_conn *fc)
        if (ring == NULL)
                return;
 
-       if (atomic_read(&ring->queue_refs) > 0) {
-               fuse_uring_abort_end_requests(ring);
+       fuse_uring_abort_end_requests(ring);
+
+       if (atomic_read(&ring->queue_refs) > 0)
                fuse_uring_stop_queues(ring);
-       }
 }
 
 static inline void fuse_uring_wait_stopped_queues(struct fuse_conn *fc)