linux/net/9p
Wang Hai 74d6a5d566 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.

We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.

Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4a ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable@vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2020-07-19 14:58:47 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile 9p: Remove p9_idpool 2018-08-29 13:39:57 +09:00
client.c 9pnet: allow making incomplete read requests 2020-03-27 09:29:56 +00:00
error.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188 2019-05-30 11:29:21 -07:00
mod.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188 2019-05-30 11:29:21 -07:00
protocol.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188 2019-05-30 11:29:21 -07:00
trans_common.c net/9p: include trans_common.h to fix missing prototype warning. 2018-11-20 15:04:16 +09:00
trans_common.h net/9p: remove (now-)unused helpers 2015-04-11 22:28:29 -04:00
trans_fd.c 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work 2020-07-19 14:58:47 +02:00
trans_rdma.c rdma: Enable ib_alloc_cq to spread work over a device's comp_vectors 2019-08-05 11:50:32 -04:00
trans_virtio.c 9p pull request for inclusion in 5.13 2019-07-12 17:31:19 -07:00
trans_xen.c 9p/xen: increase XEN_9PFS_RING_ORDER 2020-06-02 08:00:39 +02:00