diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2018-09-28 16:43:22 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-11-21 09:27:40 +0100 |
| commit | f04651b97aed95cc82fc49997de1e5b1a6990e97 (patch) | |
| tree | bbf6f19549312ca71c0a0b4973c2e08fb40185d4 | |
| parent | 2fe23468dae467043183e301829827c17f65f45f (diff) | |
| download | linux-rt-f04651b97aed95cc82fc49997de1e5b1a6990e97.tar.gz | |
fuse: set FR_SENT while locked
commit 4c316f2f3ff315cb48efb7435621e5bfb81df96d upstream.
Otherwise fuse_dev_do_write() could come in and finish off the request, and
the set_bit(FR_SENT, ...) could trigger the WARN_ON(test_bit(FR_SENT, ...))
in request_end().
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Reported-by: syzbot+ef054c4d3f64cd7f7cec@syzkaller.appspotmai
Fixes: 46c34a348b0a ("fuse: no fc->lock for pqueue parts")
Cc: <stable@vger.kernel.org> # v4.2
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/fuse/dev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index da31954e1a99..18e2f54737d1 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1336,8 +1336,8 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, } list_move_tail(&req->list, &fpq->processing); __fuse_get_request(req); - spin_unlock(&fpq->lock); set_bit(FR_SENT, &req->flags); + spin_unlock(&fpq->lock); /* matches barrier in request_wait_answer() */ smp_mb__after_atomic(); if (test_bit(FR_INTERRUPTED, &req->flags)) |