/net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
Subsystems (3)
PATCH 1/1 /net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by p9_fd_close() to stop the async polling associated with the data regarding the connection.
---
As shown by Syzbot, it is possible to provoke a race between p9_fd_close() and p9_poll_workfn() that is called to take care of the async read/write work to do. To make sure p9_fd_close() frees "trans" when it is not used anymore, it has to explicitly call flush_scheduled_work() before the kfree().
net/9p/trans_fd.c | 2 ++ 1 file changed, 2 insertions(+)
net/9p/trans_fd.c +2 -0
@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m)spin_lock_irqsave (&p9_poll_lock, flags);list_del_init (&m->poll_pending_link);spin_unlock_irqrestore (&p9_poll_lock, flags); + +flush_scheduled_work (); }/**
Signature · 1 line
2.11.0
Quoted 20 lines · Tomas Bortoli
The patch adds the flush in
p9_mux_poll_stop()as it the function used byp9_conn_destroy(), in turn called byp9_fd_close()to stop the async polling associated with the data regarding the connection.Signed-off-by Tomas Bortoli <[email protected]>Reported-by [email protected]---
As shown by Syzbot, it is possible to provoke a race betweenp9_fd_close()andp9_poll_workfn()that is called to take care of the async read/write work to do. To make surep9_fd_close()frees "trans" when it is not used anymore, it has to explicitly callflush_scheduled_work()before thekfree().net/9p/trans_fd.c | 2 ++ 1 file changed, 2 insertions(+)net/9p/trans_fd.c +0
-0
net/9p/trans_fd.c static void p9_mux_poll_stop(struct p9_conn *m) · line 189
Quoted 5 lines
net/9p/trans_fd.c +2
-0@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m)spin_lock_irqsave (&p9_poll_lock, flags);list_del_init (&m->poll_pending_link);spin_unlock_irqrestore (&p9_poll_lock, flags); + +flush_scheduled_work ();
I suggest we should use flush_work(&p9_poll_work), flush_scheduled_work is not suitable.
Thanks.
Quoted 4 lines
net/9p/trans_fd.c +0
-0}/**