summaryrefslogtreecommitdiff
path: root/net/9p
diff options
context:
space:
mode:
authorTomas Bortoli <tomasbortoli@gmail.com>2018-07-20 11:27:30 +0200
committerDominique Martinet <dominique.martinet@cea.fr>2018-08-13 09:34:58 +0900
commit430ac66eb4c5b5c4eb846b78ebf65747510b30f1 (patch)
tree231ed517b90b2417c631ed567e27b2f983ea1751 /net/9p
parent31934da810365f603dec5a67e690e00cf900fc73 (diff)
net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by p9_fd_close() to stop the async polling associated with the data regarding the connection. Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.com Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com To: Eric Van Hensbergen <ericvh@gmail.com> To: Ron Minnich <rminnich@sandia.gov> To: Latchesar Ionkov <lucho@ionkov.net> Cc: Yiwen Jiang <jiangyiwen@huwei.com> Cc: stable@vger.kernel.org Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Diffstat (limited to 'net/9p')
-rw-r--r--net/9p/trans_fd.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 588bf88c3305..b161184f77f6 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m)
spin_lock_irqsave(&p9_poll_lock, flags);
list_del_init(&m->poll_pending_link);
spin_unlock_irqrestore(&p9_poll_lock, flags);
+
+ flush_work(&p9_poll_work);
}
/**