Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3472f74 authored by Wang Hai's avatar Wang Hai Committed by Greg Kroah-Hartman
Browse files

9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work 

commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 upstream.

p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.

We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.

Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com


Fixes: 60ff779c ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable@vger.kernel.org> # v3.12+
Reported-by: default avatar <syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 96f10594

net/9p/trans_fd.c

+14 −1
Original line number Diff line number Diff line
@@ -362,6 +362,10 @@ static void p9_read_work(struct work_struct *work) 
		if (m->rreq->status == REQ_STATUS_SENT) {

			list_del(&m->rreq->req_list);

			p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);

		} else if (m->rreq->status == REQ_STATUS_FLSHD) {

			/* Ignore replies associated with a cancelled request. */

			p9_debug(P9_DEBUG_TRANS,

				 "Ignore replies associated with a cancelled request\n");

		} else {

			spin_unlock(&m->client->lock);

			p9_debug(P9_DEBUG_ERROR,
@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) 
{

	p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);



	spin_lock(&client->lock);

	/* Ignore cancelled request if message has been received

	 * before lock.

	 */

	if (req->status == REQ_STATUS_RCVD) {

		spin_unlock(&client->lock);

		return 0;

	}



	/* we haven't received a response for oldreq,

	 * remove it from the list.

	 */

	spin_lock(&client->lock);

	list_del(&req->req_list);

	req->status = REQ_STATUS_FLSHD;

	spin_unlock(&client->lock);

	p9_req_put(req);