Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 12 Jun 2020 11:10:44 +0200
From:   Dominique Martinet <asmadeus@codewreck.org>
To:     Wang Hai <wanghai38@huawei.com>
Cc:     ericvh@gmail.com, lucho@ionkov.net, davem@davemloft.net,
        v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] 9p/trans_fd: Fix concurrency del of req_list in
 p9_fd_cancelled/p9_read_work
Message-ID: <20200612091044.GA11129@nautica>
References: <20200612090833.36149-1-wanghai38@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <20200612090833.36149-1-wanghai38@huawei.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Wang Hai wrote on Fri, Jun 12, 2020:
> p9_read_work and p9_fd_cancelled may be called concurrently.
> In some cases, req->req_list may be deleted by both p9_read_work
> and p9_fd_cancelled.
> 
> We can fix it by ignoring replies associated with a cancelled
> request and ignoring cancelled request if message has been received
> before lock.
> 
> Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
> Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
> Signed-off-by: Wang Hai <wanghai38@huawei.com>

Thanks! looks good to me, I'll queue for 5.9 as well unless you're in a
hurry.
-- 
Dominique