Re: [PATCH 2/2] 9p/trans_fd: put worker reqs on destroy
flat view
From: Tomas Bortoli <hidden>
Date: 2018-10-09 13:19:57
Also in:
lkml
Il giorno mar 9 ott 2018 alle ore 06:06 Dominique Martinet [off-list ref] ha scritto:
From: Dominique Martinet <redacted>
p9_read_work/p9_write_work might still hold references to a req after
having been cancelled; make sure we put any of these to avoid potential
request leak on disconnect.
Fixes: 728356dedeff8 ("9p: Add refcount to p9_req_t")
Signed-off-by: Dominique Martinet <redacted>
Cc: Eric Van Hensbergen <redacted>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: Tomas Bortoli <redacted>Reviewed-by: Tomas Bortoli <redacted>
quoted hunk ↗ jump to hunk
--- Noticed we could leak a ref while looking at the syzbot report, this should be safe enough after the work has been cancelled... Probably. net/9p/trans_fd.c | 8 ++++++++ 1 file changed, 8 insertions(+)diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index a0317d459cde..f868cf6fba79 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c@@ -876,7 +876,15 @@ static void p9_conn_destroy(struct p9_conn *m) p9_mux_poll_stop(m); cancel_work_sync(&m->rq); + if (m->rreq) { + p9_req_put(m->rreq); + m->rreq = NULL; + } cancel_work_sync(&m->wq); + if (m->wreq) { + p9_req_put(m->wreq); + m->wreq = NULL; + } p9_conn_cancel(m, -ECONNRESET); --2.19.1
LGTM -- Tomas