[PATCH v1 0/3] fuse: fix io-uring abort races and cancel null deref

[Joanne Koong <joannelkoong@gmail.com>]

Patches 1 and 2 fix races between fuse uring ring creation and abort and
registration and abort that can result in indefinite hangs during unmount and
leaked resources.

Patch 3 fixes fuse_uring_cancel() moving cancelled entries (which have no
fuse_req) to ent_in_userspace, which can crash ent_list_request_expired().
It also removes the queue_refs > 0 gate in fuse_uring_abort() so that
request flushing always happens, since cancel now decrements queue_refs
directly.

[1] https://lore.kernel.org/linux-fsdevel/adiiTGjP1tqZfIrI@fedora/

Joanne Koong (3):
  fuse: fix race between ring creation and connection abortion
  fuse: fix race between registration and connection abortion
  fuse: fix moving cancelled entry to ent_in_userspace list

 fs/fuse/dev_uring.c   | 32 ++++++++++++++++++++++++--------
 fs/fuse/dev_uring_i.h |  6 +++---
 2 files changed, 27 insertions(+), 11 deletions(-)

-- 
2.52.0