Commit 2b319d1f authored by Miklos Szeredi's avatar Miklos Szeredi

fuse: don't dereference req->args on finished request

Move the check for async request after check for the request being already
finished and done with.

Reported-by: syzbot+ae0bb7aae3de6b4594e2@syzkaller.appspotmail.com
Fixes: d4993774 ("fuse: stop copying args to fuse_req")
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent 3f22c746
......@@ -276,10 +276,12 @@ static void flush_bg_queue(struct fuse_conn *fc)
void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req)
{
struct fuse_iqueue *fiq = &fc->iq;
bool async = req->args->end;
bool async;
if (test_and_set_bit(FR_FINISHED, &req->flags))
goto put_request;
async = req->args->end;
/*
* test_and_set_bit() implies smp_mb() between bit
* changing and below intr_entry check. Pairs with
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment