[Devel] [PATCH RHEL7 COMMIT] ms/fuse: set FR_SENT while locked

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-862.14.4.vz7.72.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-862.14.4.vz7.72.2
------>
commit a58848dad2c6c5d0da4f7508e171e9d3e21a81d9
Author: Miklos Szeredi <mszeredi at redhat.com>
Date:   Mon Oct 1 18:18:16 2018 +0300

    ms/fuse: set FR_SENT while locked
    
    Otherwise fuse_dev_do_write() could come in and finish off the request, and
    the set_bit(FR_SENT, ...) could trigger the WARN_ON(test_bit(FR_SENT, ...))
    in request_end().
    
    Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>
    Reported-by: syzbot+ef054c4d3f64cd7f7cec at syzkaller.appspotmai
    Fixes: 46c34a348b0a ("fuse: no fc->lock for pqueue parts")
    Cc: <stable at vger.kernel.org> # v4.2
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
    
    =====================
    Patchset description:
    
    Relax lock contention and ms fixes
    
    https://pmc.acronis.com/browse/VSTOR-9810
    
    Port some ms fixes and begin first round of relaxing fc->lock contention.
    
    Kirill Tkhai (5):
          fuse: Fix use-after-free in fuse_dev_do_read()
          fuse: Fix use-after-free in fuse_dev_do_write()
          fuse: use list_first_entry() in flush_bg_queue()
          fuse: use READ_ONCE on congestion_threshold and max_background
          fuse: add locking to max_background and congestion_threshold changes
    
    Miklos Szeredi (2):
          fuse: set FR_SENT while locked
          fuse: fix blocked_waitq wakeup
---
 fs/fuse/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 332c6e6aea84..8c0840b2e3e4 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1379,8 +1379,8 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 	}
 	list_move_tail(&req->list, &fpq->processing[fuse_req_hash(req)]);
 	__fuse_get_request(req);
-	spin_unlock(&fpq->lock);
 	set_bit(FR_SENT, &req->flags);
+	spin_unlock(&fpq->lock);
 	/* matches barrier in request_wait_answer() */
 	smp_mb__after_atomic();
 	if (test_bit(FR_INTERRUPTED, &req->flags))