lkml.org 
[lkml]   [2018]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 121/165] fuse: fix unlocked access to processing queue
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Miklos Szeredi <mszeredi@redhat.com>

    commit 45ff350bbd9d0f0977ff270a0d427c71520c0c37 upstream.

    fuse_dev_release() assumes that it's the only one referencing the
    fpq->processing list, but that's not true, since fuse_abort_conn() can be
    doing the same without any serialization between the two.

    Fixes: c3696046beb3 ("fuse: separate pqueue for clones")
    Cc: <stable@vger.kernel.org> # v4.2
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/fuse/dev.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -2148,9 +2148,15 @@ int fuse_dev_release(struct inode *inode
    if (fud) {
    struct fuse_conn *fc = fud->fc;
    struct fuse_pqueue *fpq = &fud->pq;
    + LIST_HEAD(to_end);

    + spin_lock(&fpq->lock);
    WARN_ON(!list_empty(&fpq->io));
    - end_requests(fc, &fpq->processing);
    + list_splice_init(&fpq->processing, &to_end);
    + spin_unlock(&fpq->lock);
    +
    + end_requests(fc, &to_end);
    +
    /* Are we the last open device? */
    if (atomic_dec_and_test(&fc->dev_count)) {
    WARN_ON(fc->iq.fasync != NULL);

    \
     
     \ /
      Last update: 2018-09-03 19:46    [W:4.952 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site