]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
net/9p: use a dedicated spinlock for trans_fd
authorDominique Martinet <asmadeus@codewreck.org>
Sun, 4 Sep 2022 11:17:49 +0000 (20:17 +0900)
committerThomas Lamprecht <t.lamprecht@proxmox.com>
Wed, 14 Dec 2022 12:59:32 +0000 (13:59 +0100)
commitcc9cde9568008867d331d1be446528af2bd08df0
tree68f26861b39b39540b8030a1decd8275d57bcbc3
parent250b4aa7ea6b67807286aeab58377f5f294b5934
net/9p: use a dedicated spinlock for trans_fd

commit 296ab4a813841ba1d5f40b03190fd1bd8f25aab0 upstream.

Shamelessly copying the explanation from Tetsuo Handa's suggested
patch[1] (slightly reworded):
syzbot is reporting inconsistent lock state in p9_req_put()[2],
for p9_tag_remove() from p9_req_put() from IRQ context is using
spin_lock_irqsave() on "struct p9_client"->lock but trans_fd
(not from IRQ context) is using spin_lock().

Since the locks actually protect different things in client.c and in
trans_fd.c, just replace trans_fd.c's lock by a new one specific to the
transport (client.c's protect the idr for fid/tag allocations,
while trans_fd.c's protects its own req list and request status field
that acts as the transport's state machine)

Link: https://lore.kernel.org/r/20220904112928.1308799-1-asmadeus@codewreck.org
Link: https://lkml.kernel.org/r/2470e028-9b05-2013-7198-1fdad071d999@I-love.SAKURA.ne.jp
Link: https://syzkaller.appspot.com/bug?extid=2f20b523930c32c160cc
Reported-by: syzbot <syzbot+2f20b523930c32c160cc@syzkaller.appspotmail.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 43bbadb7e4636dc02f6a283c2a39e6438e6173cd)
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
net/9p/trans_fd.c