diff options
| author | Wang Hai <wanghai38@huawei.com> | 2020-06-12 12:08:33 +0300 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2020-07-19 15:58:47 +0300 |
| commit | 74d6a5d5662975aed7f25952f62efbb6f6dadd29 (patch) | |
| tree | c31cb1d3bcd23daf8d7e73df4616025b6be93ace /net/ipv6/udp_offload.c | |
| parent | a39c46067c845a8a2d7144836e9468b7f072343e (diff) | |
| download | linux-74d6a5d5662975aed7f25952f62efbb6f6dadd29.tar.xz | |
9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
p9_read_work and p9_fd_cancelled may be called concurrently.
In some cases, req->req_list may be deleted by both p9_read_work
and p9_fd_cancelled.
We can fix it by ignoring replies associated with a cancelled
request and ignoring cancelled request if message has been received
before lock.
Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
Cc: <stable@vger.kernel.org> # v3.12+
Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'net/ipv6/udp_offload.c')
0 files changed, 0 insertions, 0 deletions