• Tahsin Erdogan's avatar
    fuse: clear FR_PENDING flag when moving requests out of pending queue · a8a86d78
    Tahsin Erdogan authored
    fuse_abort_conn() moves requests from pending list to a temporary list
    before canceling them. This operation races with request_wait_answer()
    which also tries to remove the request after it gets a fatal signal. It
    checks FR_PENDING flag to determine whether the request is still in the
    pending list.
    
    Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
    does not remove the request from temporary list.
    
    This bug causes an Oops when trying to delete an already deleted list entry
    in end_requests().
    
    Fixes: ee314a87 ("fuse: abort: no fc->lock needed for request ending")
    Signed-off-by: default avatarTahsin Erdogan <tahsin@google.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    Cc: <stable@vger.kernel.org> # 4.2+
    a8a86d78
dev.c 51 KB