svn commit: r349661 - stable/11/sys/fs/cuse

[Hans Petter Selasky]

Author: hselasky
Date: Wed Jul  3 18:15:00 2019
New Revision: 349661
URL: https://svnweb.freebsd.org/changeset/base/349661

Log:
  MFC r349367:
  Fix for deadlock situation in cuse(3)
  
  The final server unref should be done by the server thread to prevent
  deadlock in the client cdevpriv destructor, which cannot destroy
  itself.
  
  Sponsored by:	Mellanox Technologies

Modified:
  stable/11/sys/fs/cuse/cuse.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/fs/cuse/cuse.c
==============================================================================
--- stable/11/sys/fs/cuse/cuse.c	Wed Jul  3 18:14:00 2019	(r349660)
+++ stable/11/sys/fs/cuse/cuse.c	Wed Jul  3 18:15:00 2019	(r349661)
@@ -701,12 +701,38 @@ cuse_server_unref(struct cuse_server *pcs)
 	free(pcs, M_CUSE);
 }
 
+static int
+cuse_server_do_close(struct cuse_server *pcs)
+{
+	int retval;
+
+	cuse_lock();
+	cuse_server_is_closing(pcs);
+	/* final client wakeup, if any */
+	cuse_server_wakeup_all_client_locked(pcs);
+
+	knlist_clear(&pcs->selinfo.si_note, 1);
+
+	retval = pcs->refs;
+	cuse_unlock();
+
+	return (retval);
+}
+
 static void
 cuse_server_free(void *arg)
 {
 	struct cuse_server *pcs = arg;
 
-	/* drop refcount */
+	/*
+	 * The final server unref should be done by the server thread
+	 * to prevent deadlock in the client cdevpriv destructor,
+	 * which cannot destroy itself.
+	 */
+	while (cuse_server_do_close(pcs) != 1)
+		pause("W", hz);
+
+	/* drop final refcount */
 	cuse_server_unref(pcs);
 }
 
@@ -748,21 +774,10 @@ static int
 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 {
 	struct cuse_server *pcs;
-	int error;
 
-	error = cuse_server_get(&pcs);
-	if (error != 0)
-		goto done;
+	if (cuse_server_get(&pcs) == 0)
+		cuse_server_do_close(pcs);
 
-	cuse_lock();
-	cuse_server_is_closing(pcs);
-	/* final client wakeup, if any */
-	cuse_server_wakeup_all_client_locked(pcs);
-
-	knlist_clear(&pcs->selinfo.si_note, 1);
-	cuse_unlock();
-
-done:
 	return (0);
 }