[PATCH] net/9p/trans_fd.c: fix double list_del() and race in access
From: Tomas Bortoli <hidden>
Date: 2018-07-20 13:28:26
Also in:
lkml
Subsystem:
9p file system, the rest · Maintainers:
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet, Linus Torvalds
This patch uses list_del_init() instead of list_del() to eliminate "req_list". This to prevent double list_del()'s calls to the same list from provoking a GPF. Furthermore, this patch fixes an access to "req_list" that was made without getting the relative lock. Signed-off-by: Tomas Bortoli <redacted> Reported-by: syzbot+735d926e9d1317c3310c@syzkaller.appspotmail.com --- net/9p/trans_fd.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index a64b01c56e30..131bb1f059e6 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c@@ -223,7 +223,9 @@ static void p9_conn_cancel(struct p9_conn *m, int err) list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) { p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req); - list_del(&req->req_list); + spin_lock_irqsave(&m->client->lock, flags); + list_del_init(&req->req_list); + spin_unlock_irqrestore(&m->client->lock, flags); if (!req->t_err) req->t_err = err; p9_client_cb(m->client, req, REQ_STATUS_ERROR);
@@ -369,7 +371,7 @@ static void p9_read_work(struct work_struct *work) spin_lock(&m->client->lock); if (m->req->status != REQ_STATUS_ERROR) status = REQ_STATUS_RCVD; - list_del(&m->req->req_list); + list_del_init(&m->req->req_list); spin_unlock(&m->client->lock); p9_client_cb(m->client, m->req, status); m->rc.sdata = NULL;
@@ -684,7 +686,7 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req) spin_lock(&client->lock); if (req->status == REQ_STATUS_UNSENT) { - list_del(&req->req_list); + list_del_init(&req->req_list); req->status = REQ_STATUS_FLSHD; ret = 0; }
@@ -701,7 +703,7 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) * remove it from the list. */ spin_lock(&client->lock); - list_del(&req->req_list); + list_del_init(&req->req_list); spin_unlock(&client->lock); return 0;
--
2.11.0