Commit 9b5f361a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse fixes from Miklos Szeredi:
 "A couple of fixes, all bound for -stable (i.e. not regressions in this
  cycle)"

* tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix use-after-free in fuse_direct_IO()
  fuse: fix possibly missed wake-up after abort
  fuse: fix leaked notify reply
parents da5322e6 ebacb812
...@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background) ...@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
static void fuse_drop_waiting(struct fuse_conn *fc) static void fuse_drop_waiting(struct fuse_conn *fc)
{ {
if (fc->connected) { /*
atomic_dec(&fc->num_waiting); * lockess check of fc->connected is okay, because atomic_dec_and_test()
} else if (atomic_dec_and_test(&fc->num_waiting)) { * provides a memory barrier mached with the one in fuse_wait_aborted()
* to ensure no wake-up is missed.
*/
if (atomic_dec_and_test(&fc->num_waiting) &&
!READ_ONCE(fc->connected)) {
/* wake up aborters */ /* wake up aborters */
wake_up_all(&fc->blocked_waitq); wake_up_all(&fc->blocked_waitq);
} }
...@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, ...@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
req->in.args[1].size = total_len; req->in.args[1].size = total_len;
err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
if (err) if (err) {
fuse_retrieve_end(fc, req); fuse_retrieve_end(fc, req);
fuse_put_request(fc, req);
}
return err; return err;
} }
...@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn); ...@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
void fuse_wait_aborted(struct fuse_conn *fc) void fuse_wait_aborted(struct fuse_conn *fc)
{ {
/* matches implicit memory barrier in fuse_drop_waiting() */
smp_mb();
wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0); wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
} }
......
...@@ -2924,10 +2924,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) ...@@ -2924,10 +2924,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
} }
if (io->async) { if (io->async) {
bool blocking = io->blocking;
fuse_aio_complete(io, ret < 0 ? ret : 0, -1); fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
/* we have a non-extending, async request, so return */ /* we have a non-extending, async request, so return */
if (!io->blocking) if (!blocking)
return -EIOCBQUEUED; return -EIOCBQUEUED;
wait_for_completion(&wait); wait_for_completion(&wait);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment