Messages in this thread Patch in this message | | | From | Dominique Martinet <> | Subject | [PATCH 1/2 v2] 9p: client_create/destroy: only call trans_mod->close after create | Date | Thu, 29 Sep 2022 06:58:00 +0900 |
| |
destroy code would incorrectly call close() if trans_mod exists after some hasty code cleanup: we need to make sure we only call close after create
Link: https://lkml.kernel.org/r/00000000000015ac7905e97ebaed@google.com Reported-by: syzbot+67d13108d855f451cafc@syzkaller.appspotmail.com Reported-by: Leon Romanovsky <leon@kernel.org> Fixes: 3ff51294a055 ("9p: p9_client_create: use p9_client_destroy on failure") Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> ---
As pointed out in later mail, rdma actually does set trans->priv then fails, so we also need to reset clnt->trans on create errors.
That's getting uglier than I wish it'd be, but the cleanup code I just trashed away really isn't pretty either so I guess it'll have to do... At least close() should now really never be called on create failures.
net/9p/client.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/9p/client.c b/net/9p/client.c index bfa80f01992e..8cf952f2de68 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -971,6 +971,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) spin_lock_init(&clnt->lock); idr_init(&clnt->fids); idr_init(&clnt->reqs); + clnt->trans = ERR_PTR(-EINVAL); err = parse_opts(options, clnt); if (err < 0) @@ -990,8 +991,14 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) clnt, clnt->trans_mod, clnt->msize, clnt->proto_version); err = clnt->trans_mod->create(clnt, dev_name, options); - if (err) + // ensure clnt->trans is initialized to call close() on destroy + // if and only if create succeeded + if (err < 0) { + clnt->trans = PTR_ERR(err); goto out; + } + if (IS_ERR(clnt->trans)) + clnt->trans = NULL; if (clnt->msize > clnt->trans_mod->maxsize) { clnt->msize = clnt->trans_mod->maxsize; @@ -1036,7 +1043,7 @@ void p9_client_destroy(struct p9_client *clnt) p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt); - if (clnt->trans_mod) + if (clnt->trans_mod && !IS_ERR(client->trans)) clnt->trans_mod->close(clnt); v9fs_put_trans(clnt->trans_mod); -- 2.35.1
| |