Wang Hai 7271d03240 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work ... commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 upstream. p9_read_work and p9_fd_cancelled may be called concurrently. In some cases, req->req_list may be deleted by both p9_read_work and p9_fd_cancelled. We can fix it by ignoring replies associated with a cancelled request and ignoring cancelled request if message has been received before lock. Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com Fixes: 60ff779c4a ("9p: client: remove unused code and any reference to "cancelled" function") Cc: <stable@vger.kernel.org> # v3.12+ Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com Signed-off-by: Wang Hai <wanghai38@huawei.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-08-05 10:06:01 +02:00
..
client.c	9p: Transport error uninitialized	2019-10-11 18:21:12 +02:00
error.c
Kconfig
Makefile
mod.c
protocol.c	9p: p9dirent_read: check network-provided name length	2019-07-03 13:14:42 +02:00
protocol.h
trans_common.c	net/9p: include trans_common.h to fix missing prototype warning.	2019-07-03 13:14:43 +02:00
trans_common.h
trans_fd.c	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work	2020-08-05 10:06:01 +02:00
trans_rdma.c	9p/rdma: remove useless check in cm_event_handler	2019-07-03 13:14:42 +02:00
trans_virtio.c	9p/virtio: Add cleanup path in p9_virtio_init	2019-07-26 09:14:25 +02:00
trans_xen.c	9p/xen: Add cleanup path in p9_trans_xen_init	2019-07-26 09:14:25 +02:00
util.c