[Devel] [PATCH vz7 43/46] fuse: clear FR_PENDING flag when moving requests out of pending queue

[Maxim Patlasov]

Backport from ml:

commit a8a86d78d673b1c99fe9b0064739fde9e9774184
Author: Tahsin Erdogan <tahsin at google.com>
Date:   Thu Jan 12 12:04:04 2017 -0800

    fuse: clear FR_PENDING flag when moving requests out of pending queue

    fuse_abort_conn() moves requests from pending list to a temporary list
    before canceling them. This operation races with request_wait_answer()
    which also tries to remove the request after it gets a fatal signal. It
    checks FR_PENDING flag to determine whether the request is still in the
    pending list.

    Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
    does not remove the request from temporary list.

    This bug causes an Oops when trying to delete an already deleted list entry
    in end_requests().

    Fixes: ee314a870e40 ("fuse: abort: no fc->lock needed for request ending")
    Signed-off-by: Tahsin Erdogan <tahsin at google.com>
    Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>

Signed-off-by: Maxim Patlasov <mpatlasov at virtuozzo.com>
---
 fs/fuse/dev.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index d8360e6..69353e4 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2078,7 +2078,6 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head)
 		struct fuse_req *req;
 		req = list_entry(head->next, struct fuse_req, list);
 		req->out.h.error = -ECONNABORTED;
-		clear_bit(FR_PENDING, &req->flags);
 		clear_bit(FR_SENT, &req->flags);
 		list_del_init(&req->list);
 		request_end(fc, req);
@@ -2156,6 +2155,8 @@ void fuse_abort_conn(struct fuse_conn *fc)
 		spin_lock(&fiq->waitq.lock);
 		fiq->connected = 0;
 		list_splice_init(&fiq->pending, &to_end2);
+		list_for_each_entry(req, &to_end2, list)
+			clear_bit(FR_PENDING, &req->flags);
 		while (forget_pending(fiq))
 			kfree(dequeue_forget(fiq, 1, NULL));
 		wake_up_all_locked(&fiq->waitq);