summaryrefslogtreecommitdiff
path: root/fs/fuse
diff options
context:
space:
mode:
authorMiklos Szeredi <mszeredi@redhat.com>2018-07-26 17:13:11 +0300
committerMiklos Szeredi <mszeredi@redhat.com>2018-07-26 17:13:11 +0300
commit45ff350bbd9d0f0977ff270a0d427c71520c0c37 (patch)
treecb331af1112ab98d9d43ec345718899a642c82ee /fs/fuse
parent87114373ea507895a62afb10d2910bd9adac35a8 (diff)
downloadlinux-45ff350bbd9d0f0977ff270a0d427c71520c0c37.tar.xz
fuse: fix unlocked access to processing queue
fuse_dev_release() assumes that it's the only one referencing the fpq->processing list, but that's not true, since fuse_abort_conn() can be doing the same without any serialization between the two. Fixes: c3696046beb3 ("fuse: separate pqueue for clones") Cc: <stable@vger.kernel.org> # v4.2 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'fs/fuse')
-rw-r--r--fs/fuse/dev.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 8564d91c7d41..c8b197e4af9a 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2150,9 +2150,15 @@ int fuse_dev_release(struct inode *inode, struct file *file)
if (fud) {
struct fuse_conn *fc = fud->fc;
struct fuse_pqueue *fpq = &fud->pq;
+ LIST_HEAD(to_end);
+ spin_lock(&fpq->lock);
WARN_ON(!list_empty(&fpq->io));
- end_requests(fc, &fpq->processing);
+ list_splice_init(&fpq->processing, &to_end);
+ spin_unlock(&fpq->lock);
+
+ end_requests(fc, &to_end);
+
/* Are we the last open device? */
if (atomic_dec_and_test(&fc->dev_count)) {
WARN_ON(fc->iq.fasync != NULL);