fuse: fix unlocked access to processing queue

[mirror_ubuntu-bionic-kernel.git] / fs / fuse / dev.c

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index c973006eaf90cba9a50ed660cc5334a08ecf8b5e..b28cbc0532ce082dcd1e76b0de248c362afc60b2 100644 (file)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2155,9 +2155,15 @@ int fuse_dev_release(struct inode *inode, struct file *file)
        if (fud) {
                struct fuse_conn *fc = fud->fc;
                struct fuse_pqueue *fpq = &fud->pq;
+               LIST_HEAD(to_end);
 
+               spin_lock(&fpq->lock);
                WARN_ON(!list_empty(&fpq->io));
-               end_requests(fc, &fpq->processing);
+               list_splice_init(&fpq->processing, &to_end);
+               spin_unlock(&fpq->lock);
+
+               end_requests(fc, &to_end);
+
                /* Are we the last open device? */
                if (atomic_dec_and_test(&fc->dev_count)) {
                        WARN_ON(fc->iq.fasync != NULL);