![]() fuse_abort_conn() moves requests from pending list to a temporary list
before canceling them. This operation races with request_wait_answer()
which also tries to remove the request after it gets a fatal signal. It
checks FR_PENDING flag to determine whether the request is still in the
pending list.
Make fuse_abort_conn() clear FR_PENDING flag so that request_wait_answer()
does not remove the request from temporary list.
This bug causes an Oops when trying to delete an already deleted list entry
in end_requests().
Fixes:
|
||
---|---|---|
.. | ||
acl.c | ||
control.c | ||
cuse.c | ||
dev.c | ||
dir.c | ||
file.c | ||
fuse_i.h | ||
inode.c | ||
Kconfig | ||
Makefile | ||
xattr.c |