Messages in this thread Patch in this message | | | From | Tomas Bortoli <> | Subject | [PATCH] net/9p/trans_fd.c: fix double list_del() and race in access | Date | Fri, 20 Jul 2018 15:28:01 +0200 |
| |
This patch uses list_del_init() instead of list_del() to eliminate "req_list". This to prevent double list_del()'s calls to the same list from provoking a GPF. Furthermore, this patch fixes an access to "req_list" that was made without getting the relative lock.
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+735d926e9d1317c3310c@syzkaller.appspotmail.com ---
net/9p/trans_fd.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index a64b01c56e30..131bb1f059e6 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -223,7 +223,9 @@ static void p9_conn_cancel(struct p9_conn *m, int err) list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) { p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req); - list_del(&req->req_list); + spin_lock_irqsave(&m->client->lock, flags); + list_del_init(&req->req_list); + spin_unlock_irqrestore(&m->client->lock, flags); if (!req->t_err) req->t_err = err; p9_client_cb(m->client, req, REQ_STATUS_ERROR); @@ -369,7 +371,7 @@ static void p9_read_work(struct work_struct *work) spin_lock(&m->client->lock); if (m->req->status != REQ_STATUS_ERROR) status = REQ_STATUS_RCVD; - list_del(&m->req->req_list); + list_del_init(&m->req->req_list); spin_unlock(&m->client->lock); p9_client_cb(m->client, m->req, status); m->rc.sdata = NULL; @@ -684,7 +686,7 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req) spin_lock(&client->lock); if (req->status == REQ_STATUS_UNSENT) { - list_del(&req->req_list); + list_del_init(&req->req_list); req->status = REQ_STATUS_FLSHD; ret = 0; } @@ -701,7 +703,7 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) * remove it from the list. */ spin_lock(&client->lock); - list_del(&req->req_list); + list_del_init(&req->req_list); spin_unlock(&client->lock); return 0; -- 2.11.0
| |