lkml.org 
[lkml]   [2022]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/2] 9p: client_create/destroy: only call trans_mod->close after create
    Date
    destroy code would incorrectly call close() if trans_mod exists after some
    hasty code cleanup: we need to make sure we only call close after create

    Link: https://lkml.kernel.org/r/00000000000015ac7905e97ebaed@google.com
    Reported-by: syzbot+67d13108d855f451cafc@syzkaller.appspotmail.com
    Reported-by: Leon Romanovsky <leon@kernel.org>
    Fixes: 3ff51294a055 ("9p: p9_client_create: use p9_client_destroy on failure")
    Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
    ---
    I tried to make trans->create() return clnt->trans to assign directly
    from there, but rdma callbacks need clnt->trans to be set early during
    init and the diff was just too big for a simple fix.
    This should work for all transports without any change, and ensures we
    only call close if create succeeded.

    net/9p/client.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/net/9p/client.c b/net/9p/client.c
    index bfa80f01992e..40b59431a566 100644
    --- a/net/9p/client.c
    +++ b/net/9p/client.c
    @@ -971,6 +971,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
    spin_lock_init(&clnt->lock);
    idr_init(&clnt->fids);
    idr_init(&clnt->reqs);
    + clnt->trans = ERR_PTR(-EINVAL);

    err = parse_opts(options, clnt);
    if (err < 0)
    @@ -992,6 +993,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
    err = clnt->trans_mod->create(clnt, dev_name, options);
    if (err)
    goto out;
    + // ensure clnt->trans is initialized to call close() on destroy
    + if (IS_ERR(clnt->trans))
    + clnt->trans = NULL;

    if (clnt->msize > clnt->trans_mod->maxsize) {
    clnt->msize = clnt->trans_mod->maxsize;
    @@ -1036,7 +1040,7 @@ void p9_client_destroy(struct p9_client *clnt)

    p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt);

    - if (clnt->trans_mod)
    + if (clnt->trans_mod && !IS_ERR(client->trans))
    clnt->trans_mod->close(clnt);

    v9fs_put_trans(clnt->trans_mod);
    --
    2.35.1
    \
     
     \ /
      Last update: 2022-09-28 23:47    [W:3.607 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site