fuse: fix io_uring connection abort leaving requests stuck

Fix uninterruptible sleep (D state) hangs during FUSE filesystem
teardown when using io_uring. The issue manifests as processes stuck
waiting for requests that are never completed, particularly affecting
force requests like FUSE_FLUSH or when requests are created after
fuse_abort_conn() already finished.

If on daemon exit
io_uring_try_cancel_requests() runs and  calls fuse_uring_cancel()
which will teardown the entries by calling fuse_uring_entry_teardown()
before fuse_abort_conn() then we end up in fuse_uring_abort with
queue_refs == 0 and the queues are never stopped.

If the queues are stopped all new requests will be rejected, but
that does not happen, so all new calls are stuck.

Signed-off-by: Horst Birthelmer <hbirthelmer@ddn.com>
(cherry picked from commit 9550b4d)

Author: hbirth

fs/fuse/dev_uring.c

@@ -157,11 +157,10 @@ void fuse_uring_flush_bg(struct fuse_conn *fc)
 		if (!queue)
 			continue;
 
-		queue->stopped = true;
-
 		WARN_ON_ONCE(ring->fc->max_background != UINT_MAX);
 		spin_lock(&queue->lock);
 		spin_lock(&fc->bg_lock);
+		queue->stopped = true;
 		fuse_uring_flush_queue_bg(queue);
 		spin_unlock(&fc->bg_lock);
 		spin_unlock(&queue->lock);

fs/fuse/dev_uring_i.h

@@ -178,10 +178,8 @@ static inline void fuse_uring_abort(struct fuse_conn *fc)
 	if (ring == NULL)
 		return;
 
-	if (atomic_read(&ring->queue_refs) > 0) {
-		fuse_uring_flush_bg(fc);
-		fuse_uring_stop_queues(ring);
-	}
+	fuse_uring_flush_bg(fc);
+	fuse_uring_stop_queues(ring);
 }
 
 static inline void fuse_uring_wait_stopped_queues(struct fuse_conn *fc)