From: Miklos Szeredi <mszeredi@redhat.com>
Date: Thu, 26 Jul 2018 14:13:11 +0000 (+0200)
Subject: fuse: fix unlocked access to processing queue
X-Git-Tag: v4.9.125~32
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=c66025c1085c5983a64ac2a8ed733b8cefe1659d;p=platform%2Fkernel%2Flinux-amlogic.git

fuse: fix unlocked access to processing queue

commit 45ff350bbd9d0f0977ff270a0d427c71520c0c37 upstream.

fuse_dev_release() assumes that it's the only one referencing the
fpq->processing list, but that's not true, since fuse_abort_conn() can be
doing the same without any serialization between the two.

Fixes: c3696046beb3 ("fuse: separate pqueue for clones")
Cc: <stable@vger.kernel.org> # v4.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 9382ba43..d7c02eb 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2142,9 +2142,15 @@ int fuse_dev_release(struct inode *inode, struct file *file)
 	if (fud) {
 		struct fuse_conn *fc = fud->fc;
 		struct fuse_pqueue *fpq = &fud->pq;
+		LIST_HEAD(to_end);
 
+		spin_lock(&fpq->lock);
 		WARN_ON(!list_empty(&fpq->io));
-		end_requests(fc, &fpq->processing);
+		list_splice_init(&fpq->processing, &to_end);
+		spin_unlock(&fpq->lock);
+
+		end_requests(fc, &to_end);
+
 		/* Are we the last open device? */
 		if (atomic_dec_and_test(&fc->dev_count)) {
 			WARN_ON(fc->iq.fasync != NULL);