[Devel] [PATCH RHEL9 COMMIT] fs/fuse kio: cleanup the input queue of rpc on fatal abort

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-427.44.1.vz9.80.x-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh9-5.14.0-427.44.1.vz9.80.3
------>
commit 6b0a422ab064ecfbb6a530134d9c6162fb6adba5
Author: Liu Kui <kui.liu at virtuozzo.com>
Date:   Tue Dec 17 16:17:32 2024 +0800

    fs/fuse kio: cleanup the input queue of rpc on fatal abort
    
    The krpc connect msg could still be in the input queue of rpc
    when the rpc is being destroyed due to unpredictable execution
    order of the rpc_qeue_work and rpc_close_work. The close work
    can run before the queue work even though the queue work is
    scheduled before the close work.
    
    Non-empty input queue triggers the BUG_ON check in pcs_rpc_destroy.
    So we need clean up the input queue on fatal abort.
    
    Related to #VSTOR-96876
    https://virtuozzo.atlassian.net/browse/VSTOR-96876
    
    Signed-off-by: Liu Kui <kui.liu at virtuozzo.com>
    Acked-by: Alexey Kuznetsov <kuznet at virtuozzo.com>
---
 fs/fuse/kio/pcs/pcs_rpc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/fuse/kio/pcs/pcs_rpc.c b/fs/fuse/kio/pcs/pcs_rpc.c
index 9d782b6bea93..5557fc2fc9eb 100644
--- a/fs/fuse/kio/pcs/pcs_rpc.c
+++ b/fs/fuse/kio/pcs/pcs_rpc.c
@@ -207,6 +207,11 @@ void rpc_abort(struct pcs_rpc * ep, int fatal, int error)
 		msg->stage = PCS_MSG_STAGE_NONE;
 	}
 	if (fatal) {
+		/* cleanup the input_queue */
+		spin_lock(&ep->q_lock);
+		list_splice_tail_init(&ep->input_queue, &failed_list);
+		spin_unlock(&ep->q_lock);
+
 		while (!list_empty(&ep->state_queue)) {
 			struct pcs_msg * msg = list_first_entry(&ep->state_queue, struct pcs_msg, list);
 			list_move_tail(&msg->list, &failed_list);