From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dominique Martinet <asmadeus@codewreck.org>,
syzbot <syzbot+2f20b523930c32c160cc@syzkaller.appspotmail.com>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Christian Schoenebeck <linux_oss@crudebyte.com>,
Sasha Levin <sashal@kernel.org>,
ericvh@gmail.com, lucho@ionkov.net, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 20/21] net/9p: use a dedicated spinlock for trans_fd
Date: Mon, 17 Oct 2022 20:09:39 -0400 [thread overview]
Message-ID: <20221018000940.2731329-20-sashal@kernel.org> (raw)
In-Reply-To: <20221018000940.2731329-1-sashal@kernel.org>
From: Dominique Martinet <asmadeus@codewreck.org>
[ Upstream commit 296ab4a813841ba1d5f40b03190fd1bd8f25aab0 ]
Shamelessly copying the explanation from Tetsuo Handa's suggested
patch[1] (slightly reworded):
syzbot is reporting inconsistent lock state in p9_req_put()[2],
for p9_tag_remove() from p9_req_put() from IRQ context is using
spin_lock_irqsave() on "struct p9_client"->lock but trans_fd
(not from IRQ context) is using spin_lock().
Since the locks actually protect different things in client.c and in
trans_fd.c, just replace trans_fd.c's lock by a new one specific to the
transport (client.c's protect the idr for fid/tag allocations,
while trans_fd.c's protects its own req list and request status field
that acts as the transport's state machine)
Link: https://lore.kernel.org/r/20220904112928.1308799-1-asmadeus@codewreck.org
Link: https://lkml.kernel.org/r/2470e028-9b05-2013-7198-1fdad071d999@I-love.SAKURA.ne.jp [1]
Link: https://syzkaller.appspot.com/bug?extid=2f20b523930c32c160cc [2]
Reported-by: syzbot <syzbot+2f20b523930c32c160cc@syzkaller.appspotmail.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/9p/trans_fd.c | 41 +++++++++++++++++++++++++----------------
1 file changed, 25 insertions(+), 16 deletions(-)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index dfce201d9884..a8c1f742148c 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -93,6 +93,7 @@ struct p9_poll_wait {
* @mux_list: list link for mux to manage multiple connections (?)
* @client: reference to client instance for this connection
* @err: error state
+ * @req_lock: lock protecting req_list and requests statuses
* @req_list: accounting for requests which have been sent
* @unsent_req_list: accounting for requests that haven't been sent
* @rreq: read request
@@ -116,6 +117,7 @@ struct p9_conn {
struct list_head mux_list;
struct p9_client *client;
int err;
+ spinlock_t req_lock;
struct list_head req_list;
struct list_head unsent_req_list;
struct p9_req_t *rreq;
@@ -191,10 +193,10 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
p9_debug(P9_DEBUG_ERROR, "mux %p err %d\n", m, err);
- spin_lock(&m->client->lock);
+ spin_lock(&m->req_lock);
if (m->err) {
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
return;
}
@@ -207,7 +209,7 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
list_move(&req->req_list, &cancel_list);
}
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req);
@@ -362,7 +364,7 @@ static void p9_read_work(struct work_struct *work)
if ((m->rreq) && (m->rc.offset == m->rc.capacity)) {
p9_debug(P9_DEBUG_TRANS, "got new packet\n");
m->rreq->rc.size = m->rc.offset;
- spin_lock(&m->client->lock);
+ spin_lock(&m->req_lock);
if (m->rreq->status == REQ_STATUS_SENT) {
list_del(&m->rreq->req_list);
p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
@@ -371,14 +373,14 @@ static void p9_read_work(struct work_struct *work)
p9_debug(P9_DEBUG_TRANS,
"Ignore replies associated with a cancelled request\n");
} else {
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
p9_debug(P9_DEBUG_ERROR,
"Request tag %d errored out while we were reading the reply\n",
m->rc.tag);
err = -EIO;
goto error;
}
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
m->rc.sdata = NULL;
m->rc.offset = 0;
m->rc.capacity = 0;
@@ -456,10 +458,10 @@ static void p9_write_work(struct work_struct *work)
}
if (!m->wsize) {
- spin_lock(&m->client->lock);
+ spin_lock(&m->req_lock);
if (list_empty(&m->unsent_req_list)) {
clear_bit(Wworksched, &m->wsched);
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
return;
}
@@ -474,7 +476,7 @@ static void p9_write_work(struct work_struct *work)
m->wpos = 0;
p9_req_get(req);
m->wreq = req;
- spin_unlock(&m->client->lock);
+ spin_unlock(&m->req_lock);
}
p9_debug(P9_DEBUG_TRANS, "mux %p pos %d size %d\n",
@@ -591,6 +593,7 @@ static void p9_conn_create(struct p9_client *client)
INIT_LIST_HEAD(&m->mux_list);
m->client = client;
+ spin_lock_init(&m->req_lock);
INIT_LIST_HEAD(&m->req_list);
INIT_LIST_HEAD(&m->unsent_req_list);
INIT_WORK(&m->rq, p9_read_work);
@@ -672,10 +675,10 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
if (m->err < 0)
return m->err;
- spin_lock(&client->lock);
+ spin_lock(&m->req_lock);
req->status = REQ_STATUS_UNSENT;
list_add_tail(&req->req_list, &m->unsent_req_list);
- spin_unlock(&client->lock);
+ spin_unlock(&m->req_lock);
if (test_and_clear_bit(Wpending, &m->wsched))
n = EPOLLOUT;
@@ -690,11 +693,13 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
{
+ struct p9_trans_fd *ts = client->trans;
+ struct p9_conn *m = &ts->conn;
int ret = 1;
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
- spin_lock(&client->lock);
+ spin_lock(&m->req_lock);
if (req->status == REQ_STATUS_UNSENT) {
list_del(&req->req_list);
@@ -702,21 +707,24 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
p9_req_put(client, req);
ret = 0;
}
- spin_unlock(&client->lock);
+ spin_unlock(&m->req_lock);
return ret;
}
static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
+ struct p9_trans_fd *ts = client->trans;
+ struct p9_conn *m = &ts->conn;
+
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
- spin_lock(&client->lock);
+ spin_lock(&m->req_lock);
/* Ignore cancelled request if message has been received
* before lock.
*/
if (req->status == REQ_STATUS_RCVD) {
- spin_unlock(&client->lock);
+ spin_unlock(&m->req_lock);
return 0;
}
@@ -725,7 +733,8 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
*/
list_del(&req->req_list);
req->status = REQ_STATUS_FLSHD;
- spin_unlock(&client->lock);
+ spin_unlock(&m->req_lock);
+
p9_req_put(client, req);
return 0;
--
2.35.1
next prev parent reply other threads:[~2022-10-18 0:20 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-18 0:09 [PATCH AUTOSEL 5.15 01/21] crypto: qcom-rng - Fix qcom_rng_of_match unused warning Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 02/21] crypto: ccp - Add a quirk to firmware update Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 03/21] gfs2: Switch from strlcpy to strscpy Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 04/21] powerpc/hw_breakpoint: Avoid relying on caller synchronization Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 05/21] cgroup: Remove data-race around cgrp_dfl_visible Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 06/21] of/fdt: Don't calculate initrd size from DT if start > end Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 07/21] objtool,x86: Teach decode about LOOP* instructions Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 08/21] locking/rwsem: Disable preemption while trying for rwsem lock Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 09/21] gfs2: Check sb_bsize_shift after reading superblock Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 10/21] powerpc/64: don't refer nr_cpu_ids in asm code when it's undefined Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 11/21] m68knommu: fix non-specific 68328 choice interrupt build failure Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 12/21] m68knommu: fix non-mmu classic 68000 legacy timer tick selection Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 13/21] of: Fix "dma-ranges" handling for bus controllers Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 14/21] x86/hyperv: Replace kmap() with kmap_local_page() Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 15/21] kmsan: disable instrumentation of unsupported common kernel code Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 16/21] kmsan: disable physical page merging in biovec Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 17/21] f2fs: fix to detect corrupted meta ino Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 18/21] 9p: trans_fd/p9_conn_cancel: drop client lock earlier Sasha Levin
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 19/21] 9p/trans_fd: always use O_NONBLOCK read/write Sasha Levin
2022-10-18 0:09 ` Sasha Levin [this message]
2022-10-18 0:09 ` [PATCH AUTOSEL 5.15 21/21] virtio_pci: don't try to use intxif pin is zero Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221018000940.2731329-20-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=asmadeus@codewreck.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=ericvh@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux_oss@crudebyte.com \
--cc=lucho@ionkov.net \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=stable@vger.kernel.org \
--cc=syzbot+2f20b523930c32c160cc@syzkaller.appspotmail.com \
--cc=v9fs-developer@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox