fuse: check connected before queueing on fpq->io
authorMiklos Szeredi <mszeredi@redhat.com>
Tue, 22 Jun 2021 07:15:35 +0000 (09:15 +0200)
committerMiklos Szeredi <mszeredi@redhat.com>
Tue, 22 Jun 2021 07:15:35 +0000 (09:15 +0200)
commit80ef08670d4c28a06a3de954bd350368780bcfef
treec7a400ebf29badaec23e1a585e9ff3785f507803
parentb89ecd60d38ec042d63bdb376c722a16f92bcb88
fuse: check connected before queueing on fpq->io

A request could end up on the fpq->io list after fuse_abort_conn() has
reset fpq->connected and aborted requests on that list:

Thread-1   Thread-2
========   ========
->fuse_simple_request()           ->shutdown
  ->__fuse_request_send()
    ->queue_request() ->fuse_abort_conn()
->fuse_dev_do_read()                ->acquire(fpq->lock)
  ->wait_for(fpq->lock)    ->set err to all req's in fpq->io
  ->release(fpq->lock)
  ->acquire(fpq->lock)
  ->add req to fpq->io

After the userspace copy is done the request will be ended, but
req->out.h.error will remain uninitialized.  Also the copy might block
despite being already aborted.

Fix both issues by not allowing the request to be queued on the fpq->io
list after fuse_abort_conn() has processed this list.

Reported-by: Pradeep P V K <pragalla@codeaurora.org>
Fixes: fd22d62ed0c3 ("fuse: no fc->lock for iqueue parts")
Cc: <stable@vger.kernel.org> # v4.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
fs/fuse/dev.c