summaryrefslogtreecommitdiffstats
path: root/net/9p
diff options
context:
space:
mode:
authorWang Hai <wanghai38@huawei.com>2020-06-12 17:08:33 +0800
committerDominique Martinet <asmadeus@codewreck.org>2020-07-19 14:58:47 +0200
commit74d6a5d5662975aed7f25952f62efbb6f6dadd29 (patch)
treec31cb1d3bcd23daf8d7e73df4616025b6be93ace /net/9p
parenta39c46067c845a8a2d7144836e9468b7f072343e (diff)
downloadlinux-74d6a5d5662975aed7f25952f62efbb6f6dadd29.tar.gz
linux-74d6a5d5662975aed7f25952f62efbb6f6dadd29.tar.bz2
linux-74d6a5d5662975aed7f25952f62efbb6f6dadd29.zip
9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently. In some cases, req->req_list may be deleted by both p9_read_work and p9_fd_cancelled. We can fix it by ignoring replies associated with a cancelled request and ignoring cancelled request if message has been received before lock. Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function") Cc: <stable@vger.kernel.org> # v3.12+ Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com Signed-off-by: Wang Hai <wanghai38@huawei.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'net/9p')
-rw-r--r--net/9p/trans_fd.c15
1 files changed, 14 insertions, 1 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 9c9196d30a59..12ecacf0c55f 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work)
if (m->rreq->status == REQ_STATUS_SENT) {
list_del(&m->rreq->req_list);
p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
+ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
+ /* Ignore replies associated with a cancelled request. */
+ p9_debug(P9_DEBUG_TRANS,
+ "Ignore replies associated with a cancelled request\n");
} else {
spin_unlock(&m->client->lock);
p9_debug(P9_DEBUG_ERROR,
@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+ spin_lock(&client->lock);
+ /* Ignore cancelled request if message has been received
+ * before lock.
+ */
+ if (req->status == REQ_STATUS_RCVD) {
+ spin_unlock(&client->lock);
+ return 0;
+ }
+
/* we haven't received a response for oldreq,
* remove it from the list.
*/
- spin_lock(&client->lock);
list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
spin_unlock(&client->lock);
p9_req_put(req);