The state di->size.op is set to PCS_SIZE_SHRINK in order to postpone all read
requests during shrink request execution. But, if the shrink request fails in
__fuse_request_send(), then di->size.op is never cleaned up and it remains
PCS_SIZE_SHRINK forever, and pending read requests can remain
We have GPF when Kasan checks umem->umem_tree before dereferencing it
later in vhost_umem_interval_tree_iter_first, and it is zero.
https://jira.sw.ru/browse/PSBM-90313
MS commit 6f3180afbb22 ("vhost: do not try to access device IOTLB when
not initialized")
The code will try to access
