Patch "fuse: clear FR_PENDING flag when moving requests out of pending queue" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

fuse: clear FR_PENDING flag when moving requests out of pending queue

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
fuse-clear-fr_pending-flag-when-moving-requests-out-of-pending-queue.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Tahsin Erdogan <[email protected]>
Date: Thu, 12 Jan 2017 12:04:04 -0800
Subject: fuse: clear FR_PENDING flag when moving requests out of pending queue

From: Tahsin Erdogan <[email protected]>

commit a8a86d78d673b1c99fe9b0064739fde9e9774184 upstream.

fuse_abort_conn() moves requests from pending list to a temporary list before canceling them. This operation races with request_wait_answer() which also tries to remove the request after it gets a fatal signal. It checks FR_PENDING flag to determine whether the request is still in the pending list.

Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer() does not remove the request from temporary list.

This bug causes an Oops when trying to delete an already deleted list entry in end_requests().

---
 fs/fuse/dev.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2025,7 +2025,6 @@ static void end_requests(struct fuse_con
 		struct fuse_req *req;
 		req = list_entry(head->next, struct fuse_req, list);
 		req->out.h.error = -ECONNABORTED;
-		clear_bit(FR_PENDING, &req->flags);
 		clear_bit(FR_SENT, &req->flags);
 		list_del_init(&req->list);
 		request_end(fc, req);

@@ -2103,6 +2102,8 @@ void fuse_abort_conn(struct fuse_conn *f
 		spin_lock(&fiq->waitq.lock);
 		fiq->connected = 0;
 		list_splice_init(&fiq->pending, &to_end2);
+		list_for_each_entry(req, &to_end2, list)
+			clear_bit(FR_PENDING, &req->flags);
 		while (forget_pending(fiq))
 			kfree(dequeue_forget(fiq, 1, NULL));
 		wake_up_all_locked(&fiq->waitq);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/fuse-clear-fr_pending-flag-when-moving-requests-out-of-pending-queue.patch