From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D7D15277035; Mon, 7 Apr 2025 18:17:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744049851; cv=none; b=o/omFgiHLg+t20sB2plZz5W3IUpcuFLlSoIUW88C5BmSYDqVp58seo+sJjo0EvWNojnBVtcTLrrT/T83DYDv2TNrX73oWLTQHh94Ke3slxWl9BnQvqHd25AlD0jKTKknebLIaOT8Mty5pEqGenv+Lz5of1ZHK8JeMngneGvrcf4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744049851; c=relaxed/simple; bh=fzKtl3d3oE77n9RfVMXCK6v216JhpG64+bOr7f0w/dQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IMDu0awmGlWKjIq/M83Yu8p/Rneqchu1/DchTCOz2ehvg2qPyjDC2DAbSdiQeAEsSiMMAv0xrRhAmZ20IzQLGFM2mBK/GvTwLDjVGUpEEOosWIAzNzjdjZoW0kPxGu0xBaodhbPSkBXIZaWq3QsbBGB2fv6z0xuEmXAf2ATmGMs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d15m4hWm; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d15m4hWm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABA10C4CEE7; Mon, 7 Apr 2025 18:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1744049851; bh=fzKtl3d3oE77n9RfVMXCK6v216JhpG64+bOr7f0w/dQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d15m4hWm+2L7Qp/jrzh2K+7XGAe31d+n3RXCxRG22+asPco+drcbfGJZqe6JlVHjP UIrI9uYtGn5aJBCYMWLJTpeCCNLDRUmu2LyE2+tlwQJKkkeaZLGOVScIcThLAmrKDO FVTW/gqWGShTbRxZUPu34X6YQlFjPNScPpcYOwu1QYRbCHYIaqsz4FqAG8OicFOCyx FDlKnBX7ACycf81ER7Jllw/VI8I1oG1hUeCsCQS8+Z5+OYAQrWuqdqHQRjJetIY7Pd nAzQAZQ6DTsZiK8+l6tBJHNtwq6oq4wIKKC+xR82JYzyvUiQvqiX0OIiGEfj3+g02X B5uQjJsNIe4FA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ignacio Encinas , syzbot+d69a7cc8c683c2cb7506@syzkaller.appspotmail.com, syzbot+483d6c9b9231ea7e1851@syzkaller.appspotmail.com, Dominique Martinet , Sasha Levin , ericvh@kernel.org, lucho@ionkov.net, v9fs@lists.linux.dev Subject: [PATCH AUTOSEL 6.12 5/7] 9p/trans_fd: mark concurrent read and writes to p9_conn->err Date: Mon, 7 Apr 2025 14:17:16 -0400 Message-Id: <20250407181718.3184348-5-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250407181718.3184348-1-sashal@kernel.org> References: <20250407181718.3184348-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: v9fs@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.12.22 Content-Transfer-Encoding: 8bit From: Ignacio Encinas [ Upstream commit fbc0283fbeae27b88448c90305e738991457fee2 ] Writes for the error value of a connection are spinlock-protected inside p9_conn_cancel, but lockless reads are present elsewhere to avoid performing unnecessary work after an error has been met. Mark the write and lockless reads to make KCSAN happy. Mark the write as exclusive following the recommendation in "Lock-Protected Writes with Lockless Reads" in tools/memory-model/Documentation/access-marking.txt while we are at it. Mark p9_fd_request and p9_conn_cancel m->err reads despite the fact that they do not race with concurrent writes for stylistic reasons. Reported-by: syzbot+d69a7cc8c683c2cb7506@syzkaller.appspotmail.com Reported-by: syzbot+483d6c9b9231ea7e1851@syzkaller.appspotmail.com Signed-off-by: Ignacio Encinas Message-ID: <20250318-p9_conn_err_benign_data_race-v3-1-290bb18335cc@iencinas.com> Signed-off-by: Dominique Martinet Signed-off-by: Sasha Levin --- net/9p/trans_fd.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 196060dc6138a..791e4868f2d4e 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -191,12 +191,13 @@ static void p9_conn_cancel(struct p9_conn *m, int err) spin_lock(&m->req_lock); - if (m->err) { + if (READ_ONCE(m->err)) { spin_unlock(&m->req_lock); return; } - m->err = err; + WRITE_ONCE(m->err, err); + ASSERT_EXCLUSIVE_WRITER(m->err); list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) { list_move(&req->req_list, &cancel_list); @@ -283,7 +284,7 @@ static void p9_read_work(struct work_struct *work) m = container_of(work, struct p9_conn, rq); - if (m->err < 0) + if (READ_ONCE(m->err) < 0) return; p9_debug(P9_DEBUG_TRANS, "start mux %p pos %zd\n", m, m->rc.offset); @@ -450,7 +451,7 @@ static void p9_write_work(struct work_struct *work) m = container_of(work, struct p9_conn, wq); - if (m->err < 0) { + if (READ_ONCE(m->err) < 0) { clear_bit(Wworksched, &m->wsched); return; } @@ -622,7 +623,7 @@ static void p9_poll_mux(struct p9_conn *m) __poll_t n; int err = -ECONNRESET; - if (m->err < 0) + if (READ_ONCE(m->err) < 0) return; n = p9_fd_poll(m->client, NULL, &err); @@ -665,6 +666,7 @@ static void p9_poll_mux(struct p9_conn *m) static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) { __poll_t n; + int err; struct p9_trans_fd *ts = client->trans; struct p9_conn *m = &ts->conn; @@ -673,9 +675,10 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req) spin_lock(&m->req_lock); - if (m->err < 0) { + err = READ_ONCE(m->err); + if (err < 0) { spin_unlock(&m->req_lock); - return m->err; + return err; } WRITE_ONCE(req->status, REQ_STATUS_UNSENT); -- 2.39.5