This is a note to let you know that I've just added the patch titled
fuse: fix possibly missed wake-up after abort
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fuse-fix-possibly-missed-wake-up-after-abort.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@xxxxxxxxxx>
Date: Fri, 9 Nov 2018 15:52:16 +0100
Subject: fuse: fix possibly missed wake-up after abort
From: Miklos Szeredi <mszeredi@xxxxxxxxxx>
commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 upstream.
In current fuse_drop_waiting() implementation it's possible that
fuse_wait_aborted() will not be woken up in the unlikely case that
fuse_abort_conn() + fuse_wait_aborted() runs in between checking
fc->connected and calling atomic_dec(&fc->num_waiting).
Do the atomic_dec_and_test() unconditionally, which also provides the
necessary barrier against reordering with the fc->connected check.
The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since
the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE
barrier after resetting fc->connected. However, this is not a performance
sensitive path, and adding the explicit barrier makes it easier to
document.
Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx>
Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests")
Cc: <stable@xxxxxxxxxxxxxxx> #v4.19
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/fuse/dev.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -129,9 +129,13 @@ static bool fuse_block_alloc(struct fuse
static void fuse_drop_waiting(struct fuse_conn *fc)
{
- if (fc->connected) {
- atomic_dec(&fc->num_waiting);
- } else if (atomic_dec_and_test(&fc->num_waiting)) {
+ /*
+ * lockess check of fc->connected is okay, because atomic_dec_and_test()
+ * provides a memory barrier mached with the one in fuse_wait_aborted()
+ * to ensure no wake-up is missed.
+ */
+ if (atomic_dec_and_test(&fc->num_waiting) &&
+ !READ_ONCE(fc->connected)) {
/* wake up aborters */
wake_up_all(&fc->blocked_waitq);
}
@@ -2167,6 +2171,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
void fuse_wait_aborted(struct fuse_conn *fc)
{
+ /* matches implicit memory barrier in fuse_drop_waiting() */
+ smp_mb();
wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
}
Patches currently in stable-queue which might be from mszeredi@xxxxxxxxxx are
queue-4.19/fuse-fix-possibly-missed-wake-up-after-abort.patch
queue-4.19/fuse-set-fr_sent-while-locked.patch
queue-4.19/ovl-check-whiteout-in-ovl_create_over_whiteout.patch
queue-4.19/fuse-fix-use-after-free-in-fuse_direct_io.patch
queue-4.19/fuse-fix-leaked-notify-reply.patch
queue-4.19/ovl-fix-recursive-oi-lock-in-ovl_link.patch
queue-4.19/ovl-fix-error-handling-in-ovl_verify_set_fh.patch
queue-4.19/vfs-fix-figetbsz-ioctl-on-an-overlayfs-file.patch
queue-4.19/ovl-automatically-enable-redirect_dir-on-metacopy-on.patch
queue-4.19/fuse-fix-use-after-free-in-fuse_dev_do_read.patch
queue-4.19/fuse-fix-use-after-free-in-fuse_dev_do_write.patch
queue-4.19/fuse-fix-blocked_waitq-wakeup.patch
