Tahsin Erdogan a8a86d78d6 fuse: clear FR_PENDING flag when moving requests out of pending queue
fuse_abort_conn() moves requests from pending list to a temporary list
before canceling them. This operation races with request_wait_answer()
which also tries to remove the request after it gets a fatal signal. It
checks FR_PENDING flag to determine whether the request is still in the
pending list.

Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
does not remove the request from temporary list.

This bug causes an Oops when trying to delete an already deleted list entry
in end_requests().

Fixes: ee314a870e40 ("fuse: abort: no fc->lock needed for request ending")
Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org> # 4.2+
2017-01-13 12:03:47 +01:00
..
2016-12-22 11:25:24 +00:00
2016-12-25 17:21:23 +01:00
2016-12-26 20:29:25 -08:00
2016-12-25 17:21:22 +01:00
2016-12-25 17:21:23 +01:00
2016-12-25 17:21:22 +01:00
2016-12-25 17:21:22 +01:00
2016-12-14 21:35:31 -08:00
2016-12-05 19:01:16 -05:00
2016-09-27 18:47:38 -04:00
2016-12-14 21:35:31 -08:00
2016-12-14 23:48:11 -05:00
2016-12-03 20:51:35 -05:00
2016-12-16 16:30:49 -05:00
2016-12-05 19:03:49 -05:00
2016-11-30 08:38:07 +01:00
2016-12-25 17:21:22 +01:00