Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <CAJfpegtUAHPL9tsFB85ZqjAfy0xwz7ATRcCtLbzFBo8=WnCvLw@mail.gmail.com>
 <20200209080918.1562823-1-michael+lkml@stapelberg.ch> <CAJfpegv4iL=bW3TXP3F9w1z6-LUox8KiBmw7UBcWE-0jiK0YsA@mail.gmail.com>
 <CANnVG6kYh6M30mwBHcGeFf=fhqKmWKPeUj2GYbvNgtq0hm=gXQ@mail.gmail.com>
In-Reply-To: <CANnVG6kYh6M30mwBHcGeFf=fhqKmWKPeUj2GYbvNgtq0hm=gXQ@mail.gmail.com>
From:   Miklos Szeredi <miklos@szeredi.hu>
Date:   Wed, 12 Feb 2020 09:34:20 +0100
Message-ID: <CAJfpegtX0Z3_OZFG50epWGHkW5aOMfYmn61WmqYC67aBmJyDMA@mail.gmail.com>
Subject: Re: Still a pretty bad time on 5.4.6 with fuse_request_end.
To:     Michael Stapelberg <michael+lkml@stapelberg.ch>
Cc:     fuse-devel <fuse-devel@lists.sourceforge.net>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Kyle Sanderson <kyle.leet@gmail.com>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Feb 12, 2020 at 8:58 AM Michael Stapelberg
<michael+lkml@stapelberg.ch> wrote:

> (gdb) p *req->args
> $5 =3D {
>   nodeid =3D 18446683600620026424,
>   opcode =3D 2167928246,
>   in_numargs =3D 65535,
>   out_numargs =3D 65535,
>   force =3D false,
>   noreply =3D false,
>   nocreds =3D false,
>   in_pages =3D false,
>   out_pages =3D false,
>   out_argvar =3D true,
>   page_zeroing =3D true,
>   page_replace =3D false,
>   in_args =3D {{
>       size =3D 978828800,
>       value =3D 0x2fafce0
>     }, {
>       size =3D 978992728,
>       value =3D 0xffffffff8138efaa <fuse_alloc_forget+26>
>     }, {
>       size =3D 50002688,
>       value =3D 0xffffffff8138635f <fuse_lookup_name+255>
>     }},
>   out_args =3D {{
>       size =3D 570,
>       value =3D 0xffffc90002fafb10
>     }, {
>       size =3D 6876,
>       value =3D 0x3000000001adc
>     }},
>   end =3D 0x1000100000001
> }

Okay, that looks like rubbish, the request was possibly freed and overwritt=
en.

> Independently, as a separate test, I have also modified the source like t=
his:
>
> bool async;
> bool async_early =3D req->args->end;
>
> if (test_and_set_bit(FR_FINISHED, &req->flags))
> goto put_request;
>
> async =3D req->args->end;
>
> =E2=80=A6and printed the value of async and async_early. async is true,
> async_early is false.

Can you save and print out the value of req->opcode before the
test_and_set_bit()?

Thanks,
Miklos