fuse: don't dereference req->args on finished request (2b319d1f) · Commits · 戴 / test

Move the check for async request after check for the request being already finished and done with. Reported-by:

<syzbot+ae0bb7aae3de6b4594e2@syzkaller.appspotmail.com> Fixes: ("fuse: stop copying args to fuse_req") Signed-off-by:

fs/fuse/dev.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -276,10 +276,12 @@ static void flush_bg_queue(struct fuse_conn *fc)
		void fuse_request_end(struct fuse_conn fc, struct fuse_req req)
		{
		struct fuse_iqueue *fiq = &fc->iq;
		bool async = req->args->end;
		bool async;

		if (test_and_set_bit(FR_FINISHED, &req->flags))
		goto put_request;

		async = req->args->end;
		/*
		* test_and_set_bit() implies smp_mb() between bit
		* changing and below intr_entry check. Pairs with