1 files changed, 12 insertions, 4 deletions

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ae813e609932..a5e516a40e7a 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -165,9 +165,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
 
 static void fuse_drop_waiting(struct fuse_conn *fc)
 {
-        if (fc->connected) {
-                atomic_dec(&fc->num_waiting);
-        } else if (atomic_dec_and_test(&fc->num_waiting)) {
+        /*
+         * lockess check of fc->connected is okay, because atomic_dec_and_test()
+         * provides a memory barrier mached with the one in fuse_wait_aborted()
+         * to ensure no wake-up is missed.
+         */
+        if (atomic_dec_and_test(&fc->num_waiting) &&
+            !READ_ONCE(fc->connected)) {
                 /* wake up aborters */
                 wake_up_all(&fc->blocked_waitq);
         }
@@ -1768,8 +1772,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.args[1].size = total_len;
 
         err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
-        if (err)
+        if (err) {
                 fuse_retrieve_end(fc, req);
+                fuse_put_request(fc, req);
+        }
 
         return err;
 }
@@ -2219,6 +2225,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
 
 void fuse_wait_aborted(struct fuse_conn *fc)
 {
+        /* matches implicit memory barrier in fuse_drop_waiting() */
+        smp_mb();
         wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
 }