summaryrefslogtreecommitdiffstats
path: root/net/9p
diff options
context:
space:
mode:
authorDominique Martinet <dominique.martinet@cea.fr>2018-10-09 11:18:52 +0900
committerDominique Martinet <dominique.martinet@cea.fr>2018-10-10 09:13:30 +0900
commite4ca13f7d075e551dc158df6af18fb412a1dba0a (patch)
treead307b27d11af6952e8494218d03a6c6171ec5ac /net/9p
parent72ea0321088df2c41eca8cc6160c24bcceb56ac7 (diff)
downloadlinux-e4ca13f7d075e551dc158df6af18fb412a1dba0a.tar.gz
linux-e4ca13f7d075e551dc158df6af18fb412a1dba0a.tar.bz2
linux-e4ca13f7d075e551dc158df6af18fb412a1dba0a.zip
9p/trans_fd: abort p9_read_work if req status changed
p9_read_work would try to handle an errored req even if it got put to error state by another thread between the lookup (that worked) and the time it had been fully read. The request itself is safe to use because we hold a ref to it from the lookup (for m->rreq, so it was safe to read into the request data buffer until this point), but the req_list has been deleted at the same time status changed, and client_cb already has been called as well, so we should not do either. Link: http://lkml.kernel.org/r/1539057956-23741-1-git-send-email-asmadeus@codewreck.org Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr> Reported-by: syzbot+2222c34dc40b515f30dc@syzkaller.appspotmail.com Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Latchesar Ionkov <lucho@ionkov.net>
Diffstat (limited to 'net/9p')
-rw-r--r--net/9p/trans_fd.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 12559c474dde..a0317d459cde 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -292,7 +292,6 @@ static void p9_read_work(struct work_struct *work)
__poll_t n;
int err;
struct p9_conn *m;
- int status = REQ_STATUS_ERROR;
m = container_of(work, struct p9_conn, rq);
@@ -375,11 +374,17 @@ static void p9_read_work(struct work_struct *work)
p9_debug(P9_DEBUG_TRANS, "got new packet\n");
m->rreq->rc.size = m->rc.offset;
spin_lock(&m->client->lock);
- if (m->rreq->status != REQ_STATUS_ERROR)
- status = REQ_STATUS_RCVD;
- list_del(&m->rreq->req_list);
- /* update req->status while holding client->lock */
- p9_client_cb(m->client, m->rreq, status);
+ if (m->rreq->status == REQ_STATUS_SENT) {
+ list_del(&m->rreq->req_list);
+ p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
+ } else {
+ spin_unlock(&m->client->lock);
+ p9_debug(P9_DEBUG_ERROR,
+ "Request tag %d errored out while we were reading the reply\n",
+ m->rc.tag);
+ err = -EIO;
+ goto error;
+ }
spin_unlock(&m->client->lock);
m->rc.sdata = NULL;
m->rc.offset = 0;