summaryrefslogtreecommitdiff
path: root/fs/fuse
diff options
context:
space:
mode:
authorMiklos Szeredi <mszeredi@redhat.com>2019-10-21 10:11:40 +0300
committerMiklos Szeredi <mszeredi@redhat.com>2019-10-21 10:11:40 +0300
commit2b319d1f6f92a4ced9897678113d176ee16ae85d (patch)
tree4d166771b531db8e720acc6a7f1189eb5def5615 /fs/fuse
parent3f22c7467136adfa6d2a7baf7cd5c573f0641bd1 (diff)
downloadlinux-2b319d1f6f92a4ced9897678113d176ee16ae85d.tar.xz
fuse: don't dereference req->args on finished request
Move the check for async request after check for the request being already finished and done with. Reported-by: syzbot+ae0bb7aae3de6b4594e2@syzkaller.appspotmail.com Fixes: d49937749fef ("fuse: stop copying args to fuse_req") Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'fs/fuse')
-rw-r--r--fs/fuse/dev.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index dadd617d826c..ed1abc9e33cf 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -276,10 +276,12 @@ static void flush_bg_queue(struct fuse_conn *fc)
void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req)
{
struct fuse_iqueue *fiq = &fc->iq;
- bool async = req->args->end;
+ bool async;
if (test_and_set_bit(FR_FINISHED, &req->flags))
goto put_request;
+
+ async = req->args->end;
/*
* test_and_set_bit() implies smp_mb() between bit
* changing and below intr_entry check. Pairs with