diff options
author | Wang Hai <wanghai38@huawei.com> | 2020-06-12 17:08:33 +0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-05 10:06:49 +0200 |
commit | 019221c5e5152b6417e7cd8bb98417fe9719fc4c (patch) | |
tree | a7ba809e96926c838ae9e0f16b4fe5c469a4a72e | |
parent | d1f7217b7a75cb7f59b295d7ceab1776a0affe95 (diff) |
9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
[ Upstream commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 ]
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.
We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.
Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable@vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r-- | net/9p/trans_fd.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index cbd8cfafb794..32de8afbfbf8 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -383,6 +383,10 @@ static void p9_read_work(struct work_struct *work) if (m->req->status == REQ_STATUS_SENT) { list_del(&m->req->req_list); p9_client_cb(m->client, m->req, REQ_STATUS_RCVD); + } else if (m->req->status == REQ_STATUS_FLSHD) { + /* Ignore replies associated with a cancelled request. */ + p9_debug(P9_DEBUG_TRANS, + "Ignore replies associated with a cancelled request\n"); } else { spin_unlock(&m->client->lock); p9_debug(P9_DEBUG_ERROR, @@ -717,11 +721,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) { p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); + spin_lock(&client->lock); + /* Ignore cancelled request if message has been received + * before lock. + */ + if (req->status == REQ_STATUS_RCVD) { + spin_unlock(&client->lock); + return 0; + } + /* we haven't received a response for oldreq, * remove it from the list. */ - spin_lock(&client->lock); list_del(&req->req_list); + req->status = REQ_STATUS_FLSHD; spin_unlock(&client->lock); return 0; |