Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v2] 9p/trans_fd: Fix concurrency del of req_list in
 p9_fd_cancelled/p9_read_work
To:     Dominique Martinet <asmadeus@codewreck.org>
CC:     <ericvh@gmail.com>, <lucho@ionkov.net>, <davem@davemloft.net>,
        <v9fs-developer@lists.sourceforge.net>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
References: <20200612090833.36149-1-wanghai38@huawei.com>
 <20200612091044.GA11129@nautica>
From:   "wanghai (M)" <wanghai38@huawei.com>
Message-ID: <e59d96eb-9ef6-c6c9-2572-a3f219600130@huawei.com>
Date:   Fri, 12 Jun 2020 17:22:50 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <20200612091044.GA11129@nautica>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


在 2020/6/12 17:10, Dominique Martinet 写道:
> Wang Hai wrote on Fri, Jun 12, 2020:
>> p9_read_work and p9_fd_cancelled may be called concurrently.
>> In some cases, req->req_list may be deleted by both p9_read_work
>> and p9_fd_cancelled.
>>
>> We can fix it by ignoring replies associated with a cancelled
>> request and ignoring cancelled request if message has been received
>> before lock.
>>
>> Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
>> Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
>> Signed-off-by: Wang Hai <wanghai38@huawei.com>
> Thanks! looks good to me, I'll queue for 5.9 as well unless you're in a
> hurry.
Ok, thanks.