summaryrefslogtreecommitdiffstats
path: root/fs/fuse
diff options
context:
space:
mode:
authorMiklos Szeredi <miklos@szeredi.hu>2006-01-16 22:14:26 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2006-01-16 23:15:29 -0800
commitf43b155a5a8a95b06bc0b4474fbb7311c7e9709a (patch)
tree482a03476b71498939adb9aa7ec1a4c072902927 /fs/fuse
parent222f1d69183f10d70a37de5785698fe0aa363c12 (diff)
downloadlinux-f43b155a5a8a95b06bc0b4474fbb7311c7e9709a.tar.gz
linux-f43b155a5a8a95b06bc0b4474fbb7311c7e9709a.tar.bz2
linux-f43b155a5a8a95b06bc0b4474fbb7311c7e9709a.zip
[PATCH] fuse: fix request_end()
This function used the request object after decrementing its reference count and releasing the lock. This could in theory lead to all sorts of problems. Fix and simplify at the same time. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs/fuse')
-rw-r--r--fs/fuse/dev.c18
1 files changed, 7 insertions, 11 deletions
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 9af88953db69..de402e4d8bce 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -171,19 +171,17 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
/*
* This function is called when a request is finished. Either a reply
* has arrived or it was interrupted (and not yet sent) or some error
- * occurred during communication with userspace, or the device file was
- * closed. It decreases the reference count for the request. In case
- * of a background request the reference to the stored objects are
- * released. The requester thread is woken up (if still waiting), and
- * finally the request is either freed or put on the unused_list
+ * occurred during communication with userspace, or the device file
+ * was closed. In case of a background request the reference to the
+ * stored objects are released. The requester thread is woken up (if
+ * still waiting), and finally the reference to the request is
+ * released
*
* Called with fuse_lock, unlocks it
*/
static void request_end(struct fuse_conn *fc, struct fuse_req *req)
{
- int putback;
req->finished = 1;
- putback = atomic_dec_and_test(&req->count);
spin_unlock(&fuse_lock);
if (req->background) {
down_read(&fc->sbput_sem);
@@ -197,13 +195,11 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
else if (req->in.h.opcode == FUSE_RELEASE && req->inode == NULL) {
/* Special case for failed iget in CREATE */
u64 nodeid = req->in.h.nodeid;
- __fuse_get_request(req);
fuse_reset_request(req);
fuse_send_forget(fc, req, nodeid, 1);
- putback = 0;
+ return;
}
- if (putback)
- fuse_putback_request(fc, req);
+ fuse_put_request(fc, req);
}
/*