Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20181009020949.GA29622@nautica> <1539057956-23741-1-git-send-email-asmadeus@codewreck.org>
 <1539057956-23741-2-git-send-email-asmadeus@codewreck.org>
In-Reply-To: <1539057956-23741-2-git-send-email-asmadeus@codewreck.org>
From:   Tomas Bortoli <tomasbortoli@gmail.com>
Date:   Tue, 9 Oct 2018 15:19:42 +0200
Message-ID: <CAAHj5qgBteZQOkjF-n3OXvN9e0v6NYEsqg3YOitEKW0jikTpng@mail.gmail.com>
Subject: Re: [PATCH 2/2] 9p/trans_fd: put worker reqs on destroy
To:     Dominique Martinet <asmadeus@codewreck.org>
Cc:     Dominique Martinet <dominique.martinet@cea.fr>,
        v9fs-developer@lists.sourceforge.net,
        netdev <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Eric Van Hensbergen <ericvh@gmail.com>,
        Latchesar Ionkov <lucho@ionkov.net>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Il giorno mar 9 ott 2018 alle ore 06:06 Dominique Martinet
<asmadeus@codewreck.org> ha scritto:
>
> From: Dominique Martinet <dominique.martinet@cea.fr>
>
> p9_read_work/p9_write_work might still hold references to a req after
> having been cancelled; make sure we put any of these to avoid potential
> request leak on disconnect.
>
> Fixes: 728356dedeff8 ("9p: Add refcount to p9_req_t")
> Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
> Cc: Eric Van Hensbergen <ericvh@gmail.com>
> Cc: Latchesar Ionkov <lucho@ionkov.net>
> Cc: Tomas Bortoli <tomasbortoli@gmail.com>
Reviewed-by: Tomas Bortoli <tomasbortoli@gmail.com>
> ---
> Noticed we could leak a ref while looking at the syzbot report,
> this should be safe enough after the work has been cancelled...
> Probably.
>
>  net/9p/trans_fd.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
> index a0317d459cde..f868cf6fba79 100644
> --- a/net/9p/trans_fd.c
> +++ b/net/9p/trans_fd.c
> @@ -876,7 +876,15 @@ static void p9_conn_destroy(struct p9_conn *m)
>
>         p9_mux_poll_stop(m);
>         cancel_work_sync(&m->rq);
> +       if (m->rreq) {
> +               p9_req_put(m->rreq);
> +               m->rreq = NULL;
> +       }
>         cancel_work_sync(&m->wq);
> +       if (m->wreq) {
> +               p9_req_put(m->wreq);
> +               m->wreq = NULL;
> +       }
>
>         p9_conn_cancel(m, -ECONNRESET);
>
> --
> 2.19.1
>

LGTM
--
Tomas