diff options
| author | Ming Lei <ming.lei@redhat.com> | 2024-08-30 11:41:45 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-08-30 14:46:59 -0600 |
| commit | c9ea57c91f03bcad415e1a20113bdb2077bcf990 (patch) | |
| tree | 5865f68b6cbf4a769432fbcda17dde2fd229ece2 /block | |
| parent | 12c612e115f3f021e72025447233ca89c94fb751 (diff) | |
nbd: fix race between timeout and normal completion
If request timetout is handled by nbd_requeue_cmd(), normal completion
has to be stopped for avoiding to complete this requeued request, other
use-after-free can be triggered.
Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime
make sure that cmd->lock is grabbed for clearing the flag and the
requeue.
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Yu Kuai <yukuai3@huawei.com>
Fixes: 2895f1831e91 ("nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20240830034145.1827742-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions