From patchwork Thu Jan 12 20:04:04 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tahsin Erdogan X-Patchwork-Id: 9514117 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0A03260762 for ; Thu, 12 Jan 2017 20:04:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EC670286CB for ; Thu, 12 Jan 2017 20:04:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E1D46286F6; Thu, 12 Jan 2017 20:04:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DB3A3286D2 for ; Thu, 12 Jan 2017 20:04:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751048AbdALUEi (ORCPT ); Thu, 12 Jan 2017 15:04:38 -0500 Received: from mail-pf0-f171.google.com ([209.85.192.171]:33721 "EHLO mail-pf0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751036AbdALUEh (ORCPT ); Thu, 12 Jan 2017 15:04:37 -0500 Received: by mail-pf0-f171.google.com with SMTP id y143so18097305pfb.0 for ; Thu, 12 Jan 2017 12:04:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=DYL+Y+4PdqbtbuFI7YfCL1KiZ+mDNjIkmoaezaZYl6c=; b=UCzCKm1QuywsaZGC1t2D8t98Rzqme5ojjlC7uwZa8mzwDYSanZ0gkYQpJir7Ngriwr NAiC6qnJXtaKMj3NRmHmczcXMQNQjW8CFqhDCw+J42QXb5FYGwrTKuyAmwzIO63lCwQI xN0yIAu8UMyqn2sNmkcR+xWuusYuddQNsX5WN9BBlqtMjBL/RhiLKGdOPSm9rQFkbShT JYZ8S+2biGja8RbawfFfWyqPDOca/OZ6XFuxvdrgI8d3HGGh7BH/AjhseSKS+prV1o+0 oBv929lMsJubQd4957hV1DUT4aOKQPSNjpWndlwZO9yc4wt04cnQw1kVaIAwR9yitqx1 F9sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=DYL+Y+4PdqbtbuFI7YfCL1KiZ+mDNjIkmoaezaZYl6c=; b=OSdprUviIiCEWFaZj9ZfrcGL1roc8xtsHyRL/vl6WQprKgHTmUBjuFTX0MEEgzASSb 5Nh+ASnqQOOy1Atwm1QRPRJc8WN2Rs0thPASXTcegS7slF+L67lFn0N2E3BFdmW3JXpL XqgGar9Yeyv4BRksfQhA5LkTSqnErNvU3qu9TtOn0+oAoCf4/doKOo1J2eH+FaZgJ0gl tkquiOh2axJpFHz6yRruc3p/NRQKNqKRrBZ8yZoyvlBwxEMmTs7VYFfxN5rm+x6PRkGZ e49u4frX3iIh7BzeVVj1DVVd5DrIhAvJ2tWyhWJctbI8RdZaoRaYL9M3IFOsV/eM0+EE FFPg== X-Gm-Message-State: AIkVDXKWxgXusW2NjOB8YyQ0p3FVrrjA48D0GKXQnp75M2WWl5bt/ScswGuOIcU8FXvGe3Zi X-Received: by 10.84.233.201 with SMTP id m9mr23787245pln.91.1484251476202; Thu, 12 Jan 2017 12:04:36 -0800 (PST) Received: from tahsin1.mtv.corp.google.com ([100.99.140.90]) by smtp.gmail.com with ESMTPSA id o18sm23770218pgn.36.2017.01.12.12.04.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 12 Jan 2017 12:04:35 -0800 (PST) From: Tahsin Erdogan To: Miklos Szeredi , linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Tahsin Erdogan Subject: [PATCH] fuse: clear FR_PENDING flag when moving requests out of pending queue Date: Thu, 12 Jan 2017 12:04:04 -0800 Message-Id: <20170112200404.22522-1-tahsin@google.com> X-Mailer: git-send-email 2.11.0.390.gc69c2f50cf-goog Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP fuse_abort_conn() moves requests from pending list to a temporary list before canceling them. This operation races with request_wait_answer() which also tries to remove the request after it gets a fatal signal. It checks FR_PENDING flag to determine whether the request is still in the pending list. Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer() does not remove the request from temporary list. This bug manifests itself as a panic that looks like this: general protection fault: 0000 [#1] SMP CPU: 2 PID: 1888 Comm: fusexmp Not tainted 4.9.0-rc8+ #47 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88023616a100 task.stack: ffffc90001c20000 RIP: 0010:[] [] end_requests+0x5f/0x90 RSP: 0018:ffffc90001c23b78 EFLAGS: 00010246 RAX: dead000000000200 RBX: 0000000000000000 RCX: 00000010e447a7df RDX: ffff8802331dc000 RSI: ffff8802331dc190 RDI: ffff8802336d7800 RBP: ffffc90001c23b98 R08: 0000000000000000 R09: 0000000000000000 R10: ffff880235c2b778 R11: ffff880235a22910 R12: ffff8802331dc190 R13: ffffc90001c23bc8 R14: ffff8802336d7800 R15: ffff8802331166a0 FS: 0000000000000000(0000) GS:ffff88023fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000b3c1c8 CR3: 0000000001008000 CR4: 00000000000006e0 Stack: ffff8802336d7800 ffff8802336d7878 ffff8802331166a0 ffff8802336d7800 ffffc90001c23c00 ffffffff804d77d8 ffff8802336d7d60 ffff8802336d7800 ffffc90001c23bb8 ffffc90001c23bb8 ffffc90001c23bc8 ffffc90001c23bc8 Call Trace: [] fuse_abort_conn+0x2a8/0x310 [] fuse_dev_release+0x59/0x90 [] __fput+0x9d/0x1d0 [] ____fput+0x9/0x10 [] task_work_run+0x7e/0xa0 [] do_exit+0x27b/0xa60 [] do_group_exit+0x3a/0xa0 [] get_signal+0x1aa/0x5b0 [] ? __wake_up_common+0x80/0x80 [] do_signal+0x23/0x660 [] ? fuse_dev_read+0x4f/0x60 [] exit_to_usermode_loop+0x34/0x6b [] syscall_return_slowpath+0x55/0x60 [] entry_SYSCALL_64_fastpath+0x92/0x94 Code: 84 24 9c 00 00 00 99 ff ff ff f0 41 80 64 24 30 7f f0 41 80 64 24 31 fe 49 8b 44 24 08 49 8b 14 24 4c 89 e6 4c 89 f7 48 89 42 08 <48> 89 10 4d 89 24 24 4d 89 64 24 08 e8 d0 fd ff ff 49 8b 45 00 RIP [] end_requests+0x5f/0x90 RSP ---[ end trace 7da3774b682d0b94 ]--- Signed-off-by: Tahsin Erdogan --- fs/fuse/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 70ea57c7b6bb..4e06a27ed7f8 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -2025,7 +2025,6 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head) struct fuse_req *req; req = list_entry(head->next, struct fuse_req, list); req->out.h.error = -ECONNABORTED; - clear_bit(FR_PENDING, &req->flags); clear_bit(FR_SENT, &req->flags); list_del_init(&req->list); request_end(fc, req); @@ -2103,6 +2102,8 @@ void fuse_abort_conn(struct fuse_conn *fc) spin_lock(&fiq->waitq.lock); fiq->connected = 0; list_splice_init(&fiq->pending, &to_end2); + list_for_each_entry(req, &to_end2, list) + clear_bit(FR_PENDING, &req->flags); while (forget_pending(fiq)) kfree(dequeue_forget(fiq, 1, NULL)); wake_up_all_locked(&fiq->waitq);