Zhengchao Shao 459332f8db 9p/fd: fix issue of list_del corruption in p9_fd_cancel() ... [ Upstream commit 11c1095651 ] Syz reported the following issue: kernel BUG at lib/list_debug.c:53! invalid opcode: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:__list_del_entry_valid.cold+0x5c/0x72 Call Trace: <TASK> p9_fd_cancel+0xb1/0x270 p9_client_rpc+0x8ea/0xba0 p9_client_create+0x9c0/0xed0 v9fs_session_init+0x1e0/0x1620 v9fs_mount+0xba/0xb80 legacy_get_tree+0x103/0x200 vfs_get_tree+0x89/0x2d0 path_mount+0x4c0/0x1ac0 __x64_sys_mount+0x33b/0x430 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> The process is as follows: Thread A: Thread B: p9_poll_workfn() p9_client_create() ... ... p9_conn_cancel() p9_fd_cancel() list_del() ... ... list_del() //list_del corruption There is no lock protection when deleting list in p9_conn_cancel(). After deleting list in Thread A, thread B will delete the same list again. It will cause issue of list_del corruption. Setting req->status to REQ_STATUS_ERROR under lock prevents other cleanup paths from trying to manipulate req_list. The other thread can safely check req->status because it still holds a reference to req at this point. Link: https://lkml.kernel.org/r/20221110122606.383352-1-shaozhengchao@huawei.com Fixes: 52f1c45dde ("9p: trans_fd/p9_conn_cancel: drop client lock earlier") Reported-by: syzbot+9b69b8d10ab4a7d88056@syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> [Dominique: add description of the fix in commit message] Signed-off-by: Dominique Martinet <asmadeus@codewreck.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-12-02 17:40:00 +01:00
..
client.c	net/9p: Initialize the iounit field during fid creation	2022-08-21 15:16:26 +02:00
error.c
Kconfig
Makefile
mod.c
protocol.c
protocol.h
trans_common.c
trans_common.h
trans_fd.c	9p/fd: fix issue of list_del corruption in p9_fd_cancel()	2022-12-02 17:40:00 +01:00
trans_rdma.c
trans_virtio.c	9p/trans_virtio: Remove sysfs file on probe failure	2021-09-26 14:08:57 +02:00
trans_xen.c	xen/9p: use alloc/free_pages_exact()	2022-03-11 12:11:54 +01:00