On Fri, Jul 29, 2022 at 10:47:32PM +0200, Oleg Nesterov wrote:
> On 07/29, Eric W. Biederman wrote:
> >
> > +static int fuse_flush_async(struct file *file, fl_owner_t id)
> > +{
> > + struct inode *inode = file_inode(file);
> > + struct fuse_mount *fm = get_fuse_mount(inode);
> > + struct fuse_file *ff = file->private_data;
> > + struct fuse_flush_args *fa;
> > + int err;
> > +
> > + fa = kzalloc(sizeof(*fa), GFP_KERNEL);
> > + if (!fa)
> > + return -ENOMEM;
> > +
> > + fa->inarg.fh = ff->fh;
> > + fa->inarg.lock_owner = fuse_lock_owner_id(fm->fc, id);
> > + fa->args.opcode = FUSE_FLUSH;
> > + fa->args.nodeid = get_node_id(inode);
> > + fa->args.in_numargs = 1;
> > + fa->args.in_args[0].size = sizeof(fa->inarg);
> > + fa->args.in_args[0].value = &fa->inarg;
> > + fa->args.force = true;
> > + fa->args.end = fuse_flush_end;
> > + fa->inode = inode;
> > + __iget(inode);
>
> Hmm... who does iput() ?
... or holds ->i_lock as expected by __iget()...
