lkml.org 
[lkml]   [2020]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 60/80] fuse: fix possibly missed wake-up after abort
    Date
    From: Miklos Szeredi <mszeredi@redhat.com>

    commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 upstream.

    In current fuse_drop_waiting() implementation it's possible that
    fuse_wait_aborted() will not be woken up in the unlikely case that
    fuse_abort_conn() + fuse_wait_aborted() runs in between checking
    fc->connected and calling atomic_dec(&fc->num_waiting).

    Do the atomic_dec_and_test() unconditionally, which also provides the
    necessary barrier against reordering with the fc->connected check.

    The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since
    the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE
    barrier after resetting fc->connected. However, this is not a performance
    sensitive path, and adding the explicit barrier makes it easier to
    document.

    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests")
    Cc: <stable@vger.kernel.org> #v4.19
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/fuse/dev.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -132,9 +132,13 @@ static bool fuse_block_alloc(struct fuse

    static void fuse_drop_waiting(struct fuse_conn *fc)
    {
    - if (fc->connected) {
    - atomic_dec(&fc->num_waiting);
    - } else if (atomic_dec_and_test(&fc->num_waiting)) {
    + /*
    + * lockess check of fc->connected is okay, because atomic_dec_and_test()
    + * provides a memory barrier mached with the one in fuse_wait_aborted()
    + * to ensure no wake-up is missed.
    + */
    + if (atomic_dec_and_test(&fc->num_waiting) &&
    + !READ_ONCE(fc->connected)) {
    /* wake up aborters */
    wake_up_all(&fc->blocked_waitq);
    }
    @@ -2164,6 +2168,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);

    void fuse_wait_aborted(struct fuse_conn *fc)
    {
    + /* matches implicit memory barrier in fuse_drop_waiting() */
    + smp_mb();
    wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
    }


    \
     
     \ /
      Last update: 2020-05-01 15:30    [W:4.163 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site