Messages in this thread Patch in this message | | | From | Dominique Martinet <> | Subject | [PATCH 1/2] 9p: client_create/destroy: only call trans_mod->close after create | Date | Thu, 29 Sep 2022 06:44:16 +0900 |
| |
destroy code would incorrectly call close() if trans_mod exists after some hasty code cleanup: we need to make sure we only call close after create
Link: https://lkml.kernel.org/r/00000000000015ac7905e97ebaed@google.com Reported-by: syzbot+67d13108d855f451cafc@syzkaller.appspotmail.com Reported-by: Leon Romanovsky <leon@kernel.org> Fixes: 3ff51294a055 ("9p: p9_client_create: use p9_client_destroy on failure") Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> --- I tried to make trans->create() return clnt->trans to assign directly from there, but rdma callbacks need clnt->trans to be set early during init and the diff was just too big for a simple fix. This should work for all transports without any change, and ensures we only call close if create succeeded.
net/9p/client.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/9p/client.c b/net/9p/client.c index bfa80f01992e..40b59431a566 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -971,6 +971,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) spin_lock_init(&clnt->lock); idr_init(&clnt->fids); idr_init(&clnt->reqs); + clnt->trans = ERR_PTR(-EINVAL); err = parse_opts(options, clnt); if (err < 0) @@ -992,6 +993,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) err = clnt->trans_mod->create(clnt, dev_name, options); if (err) goto out; + // ensure clnt->trans is initialized to call close() on destroy + if (IS_ERR(clnt->trans)) + clnt->trans = NULL; if (clnt->msize > clnt->trans_mod->maxsize) { clnt->msize = clnt->trans_mod->maxsize; @@ -1036,7 +1040,7 @@ void p9_client_destroy(struct p9_client *clnt) p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt); - if (clnt->trans_mod) + if (clnt->trans_mod && !IS_ERR(client->trans)) clnt->trans_mod->close(clnt); v9fs_put_trans(clnt->trans_mod); -- 2.35.1
| |