9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work (74d6a5d5) · Commits · 戴 / test

p9_read_work and p9_fd_cancelled may be called concurrently. In some cases, req->req_list may be deleted by both p9_read_work and p9_fd_cancelled. We can fix it by ignoring replies associated with a cancelled request and ignoring cancelled request if message has been received before lock. Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com Fixes: ("9p: client: remove unused code and any reference to "cancelled" function") Cc: <stable@vger.kernel.org> # v3.12+ Reported-by:

<syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com> Signed-off-by:

Wang Hai <wanghai38@huawei.com> Signed-off-by:

Dominique Martinet <asmadeus@codewreck.org>

net/9p/trans_fd.c

+14 −1

Original line number	Diff line number	Diff line
		@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work)
		if (m->rreq->status == REQ_STATUS_SENT) {
		list_del(&m->rreq->req_list);
		p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
		} else if (m->rreq->status == REQ_STATUS_FLSHD) {
		/* Ignore replies associated with a cancelled request. */
		p9_debug(P9_DEBUG_TRANS,
		"Ignore replies associated with a cancelled request\n");
		} else {
		spin_unlock(&m->client->lock);
		p9_debug(P9_DEBUG_ERROR,
		@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client client, struct p9_req_t req)
		{
		p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);

		spin_lock(&client->lock);
		/* Ignore cancelled request if message has been received
		* before lock.
		*/
		if (req->status == REQ_STATUS_RCVD) {
		spin_unlock(&client->lock);
		return 0;
		}

		/* we haven't received a response for oldreq,
		* remove it from the list.
		*/
		spin_lock(&client->lock);
		list_del(&req->req_list);
		req->status = REQ_STATUS_FLSHD;
		spin_unlock(&client->lock);
		p9_req_put(req);

Admin message