mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
![]() There's a problem in 9p's interaction with netfslib whereby a crash occurs because the 9p_fid structs get forcibly destroyed during client teardown (without paying attention to their refcounts) before netfslib has finished with them. However, it's not a simple case of deferring the clunking that p9_fid_put() does as that requires the p9_client record to still be present. The problem is that netfslib has to unlock pages and clear the IN_PROGRESS flag before destroying the objects involved - including the fid - and, in any case, nothing checks to see if writeback completed barring looking at the page flags. Fix this by keeping a count of outstanding I/O requests (of any type) and waiting for it to quiesce during inode eviction. Reported-by: syzbot+df038d463cca332e8414@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/0000000000005be0aa061846f8d6@google.com/ Reported-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000b86c5e06130da9c6@google.com/ Reported-by: syzbot+1527696d41a634cc1819@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000041f960618206d7e@google.com/ Signed-off-by: David Howells <dhowells@redhat.com> Link: https://lore.kernel.org/r/755891.1716560771@warthog.procyon.org.uk Tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Reviewed-by: Dominique Martinet <asmadeus@codewreck.org> cc: Eric Van Hensbergen <ericvh@kernel.org> cc: Latchesar Ionkov <lucho@ionkov.net> cc: Christian Schoenebeck <linux_oss@crudebyte.com> cc: Jeff Layton <jlayton@kernel.org> cc: Steve French <sfrench@samba.org> cc: Hillf Danton <hdanton@sina.com> cc: v9fs@lists.linux.dev cc: linux-afs@lists.infradead.org cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Reported-and-tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com Signed-off-by: Christian Brauner <brauner@kernel.org> |
||
---|---|---|
.. | ||
addr_list.c | ||
addr_prefs.c | ||
afs.h | ||
afs_cm.h | ||
afs_fs.h | ||
afs_vl.h | ||
callback.c | ||
cell.c | ||
cmservice.c | ||
dir.c | ||
dir_edit.c | ||
dir_silly.c | ||
dynroot.c | ||
file.c | ||
flock.c | ||
fs_operation.c | ||
fs_probe.c | ||
fsclient.c | ||
inode.c | ||
internal.h | ||
Kconfig | ||
main.c | ||
Makefile | ||
misc.c | ||
mntpt.c | ||
proc.c | ||
protocol_afs.h | ||
protocol_uae.h | ||
protocol_yfs.h | ||
rotate.c | ||
rxrpc.c | ||
security.c | ||
server.c | ||
server_list.c | ||
super.c | ||
validation.c | ||
vl_alias.c | ||
vl_list.c | ||
vl_probe.c | ||
vl_rotate.c | ||
vlclient.c | ||
volume.c | ||
write.c | ||
xattr.c | ||
xdr_fs.h | ||
yfsclient.c |