@@ -718,11 +718,18 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
{
p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
- /* we haven't received a response for oldreq,
- * remove it from the list.
+ /* If req->status == REQ_STATUS_RCVD, it means we just received a
+ * response for oldreq, we need do nothing here. Else, remove it from
+ * the list.
*/
spin_lock(&client->lock);
+ if (req->status == REQ_STATUS_RCVD) {
+ spin_unlock(&client->lock);
+ return 0;
+ }
+
list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
spin_unlock(&client->lock);
p9_req_put(req);
p9_read_work and p9_fd_cancelled may be called concurrently. Before list_del(&m->rreq->req_list) in p9_read_work is called, the req->req_list may have been deleted in p9_fd_cancelled. We can fix it by setting req->status to REQ_STATUS_FLSHD after list_del(&req->req_list) in p9_fd_cancelled. Before list_del(&req->req_list) in p9_fd_cancelled is called, the req->req_list may have been deleted in p9_read_work. We should return when req->status = REQ_STATUS_RCVD which means we just received a response for oldreq, so we need do nothing in p9_fd_cancelled. Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> --- net/9p/trans_fd.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)