From patchwork Thu Aug 20 09:19:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 265477 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70482C433E3 for ; Thu, 20 Aug 2020 12:17:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4CE1C208A9 for ; Thu, 20 Aug 2020 12:17:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597925877; bh=ETcx389IbtZs0pnuRneopJhc/DhdLoEkJcrfLvQfUnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zSz9DB9//iAf924tCrjh9BYWP95v5EthEoIQ6tHqGp1pz5k5BhJDdoJdqgOirc5oi Xb4/hIIIn/2DaBQyLuG6RQqwi2yXfQvlQAYhSNI5JU8Q/JwymJnyFPRGZkCBmcUsXu GgaXgFLRtx/7Xsd/PgTWD0m+wArzamtbewvb9wqA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730304AbgHTMRz (ORCPT ); Thu, 20 Aug 2020 08:17:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:39934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730219AbgHTJ4a (ORCPT ); Thu, 20 Aug 2020 05:56:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5A5EE20855; Thu, 20 Aug 2020 09:56:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597917389; bh=ETcx389IbtZs0pnuRneopJhc/DhdLoEkJcrfLvQfUnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YCiXHZnmsR067ROyiJdGdsFTOF3D3RHwJY5g2KWesrBHEOIbRAt0TQgh0kQkLfzp2 qL+qEIXEoWuowqVG55I89jtOPR55+Xc1YLR+sAJSvtQhyLTRgsV+fJPJpubknTMAQY CbKF1MXfZyv+tzUGghDHtWlzqmaUb6X1/SCye1q4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dominique Martinet , syzbot+2222c34dc40b515f30dc@syzkaller.appspotmail.com, Eric Van Hensbergen , Latchesar Ionkov , Sasha Levin Subject: [PATCH 4.9 015/212] 9p/trans_fd: abort p9_read_work if req status changed Date: Thu, 20 Aug 2020 11:19:48 +0200 Message-Id: <20200820091603.104543712@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820091602.251285210@linuxfoundation.org> References: <20200820091602.251285210@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dominique Martinet [ Upstream commit e4ca13f7d075e551dc158df6af18fb412a1dba0a ] p9_read_work would try to handle an errored req even if it got put to error state by another thread between the lookup (that worked) and the time it had been fully read. The request itself is safe to use because we hold a ref to it from the lookup (for m->rreq, so it was safe to read into the request data buffer until this point), but the req_list has been deleted at the same time status changed, and client_cb already has been called as well, so we should not do either. Link: http://lkml.kernel.org/r/1539057956-23741-1-git-send-email-asmadeus@codewreck.org Signed-off-by: Dominique Martinet Reported-by: syzbot+2222c34dc40b515f30dc@syzkaller.appspotmail.com Cc: Eric Van Hensbergen Cc: Latchesar Ionkov Signed-off-by: Sasha Levin --- net/9p/trans_fd.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index aa4586672cee9..91f71958c2e16 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -295,7 +295,6 @@ static void p9_read_work(struct work_struct *work) { int n, err; struct p9_conn *m; - int status = REQ_STATUS_ERROR; m = container_of(work, struct p9_conn, rq); @@ -375,11 +374,17 @@ static void p9_read_work(struct work_struct *work) if ((m->req) && (m->rc.offset == m->rc.capacity)) { p9_debug(P9_DEBUG_TRANS, "got new packet\n"); spin_lock(&m->client->lock); - if (m->req->status != REQ_STATUS_ERROR) - status = REQ_STATUS_RCVD; - list_del(&m->req->req_list); - /* update req->status while holding client->lock */ - p9_client_cb(m->client, m->req, status); + if (m->req->status == REQ_STATUS_SENT) { + list_del(&m->req->req_list); + p9_client_cb(m->client, m->req, REQ_STATUS_RCVD); + } else { + spin_unlock(&m->client->lock); + p9_debug(P9_DEBUG_ERROR, + "Request tag %d errored out while we were reading the reply\n", + m->rc.tag); + err = -EIO; + goto error; + } spin_unlock(&m->client->lock); m->rc.sdata = NULL; m->rc.offset = 0;