From nobody Sat Jul 25 16:18:26 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8858F43F0B9; Thu, 16 Jul 2026 07:31:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187113; cv=none; b=OrX+O55ej0/rsEgjElPcbg0zL9o7CXuD7vEINlpoFP02H9jEBoTvJLNNWFVZ6sMXQ1TElrNW+weCs5DdX0bcKSXfkIppDza0aaKeq+h3sRhYap8ffzV2QJfJyW0HCWDkfHtfzViWCnKm/HSqCyuZ4t/m2kaXDFKAbv4dOXWuq5g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187113; c=relaxed/simple; bh=qVBjct/4FSbp/lTowy14ehat9srNnwRVSv+9n61qO3E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=B2TbfK/K2uDL/Dy2NtKwVL2JR06BZT9GMT3DLMJDvc4CFH6w5NMcnuLsAmINW3LGr9zxP7DfjRvj/TFZLwW5vcQ697r++8cnIQgekwSIZwXYfEjMeloISuFVZCLlYscgg6VY/axqUE9cW2wxzhbw6C7BAf0ruqOfvup4j1ucPSU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 61b80dc280e811f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NO_NAME, HR_CTE_8B, HR_CTT_MISS HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME, HR_SJ_DIGIT_LEN HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM, HR_SJ_PHRASE HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_EXISTED, SN_UNTRUSTED SN_UNFAMILIAR, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU, AMN_GOOD ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:ef98318b-9b93-4073-95dd-58be883efd48,IP:10, URL:0,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:5 X-CID-INFO: VERSION:1.3.12,REQID:ef98318b-9b93-4073-95dd-58be883efd48,IP:10,UR L:0,TC:0,Content:-5,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:5 X-CID-META: VersionHash:e7bac3a,CLOUDID:b3e6e2f899dd81e4c165f96a7ff2a441,BulkI D:260716153139LFYB9YIR,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 61b80dc280e811f1aa26b74ffac11d73-20260716 X-User: tanze@kylinos.cn Received: from desktop-od00ebi.localdomain [(116.128.244.169)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1200005047; Thu, 16 Jul 2026 15:31:38 +0800 From: Ze Tan To: ericvh@kernel.org, lucho@ionkov.net, asmadeus@codewreck.org, linux_oss@crudebyte.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, v9fs@lists.linux.dev, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, tanze@kylinos.cn Subject: [PATCH v2 1/3] net/9p: handle replies racing with interrupted RPCs Date: Thu, 16 Jul 2026 15:30:49 +0800 Message-ID: <72509c9d98f3ac1baf656176b351710a4b1ac0f8.1784186316.git.tanze@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A reply can arrive after io_wait_event_killable() reports an interruption but before the client starts cancellation. In that case the request is already complete and must not be flushed or returned as an error. Recheck REQ_STATUS_RCVD before entering the flush path in both regular and zero-copy RPCs. Signed-off-by: Ze Tan --- net/9p/client.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/9p/client.c b/net/9p/client.c index ef64546c6d52..b9860ccb224b 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -612,6 +612,11 @@ p9_client_rpc(struct p9_client *c, int8_t type, const = char *fmt, ...) err =3D req->t_err; } if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected) { + if (READ_ONCE(req->status) =3D=3D REQ_STATUS_RCVD) { + err =3D 0; + goto recalc_sigpending; + } + p9_debug(P9_DEBUG_MUX, "flushing\n"); sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); @@ -697,6 +702,11 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_cli= ent *c, int8_t type, err =3D req->t_err; } if (err =3D=3D -ERESTARTSYS && c->status =3D=3D Connected) { + if (READ_ONCE(req->status) =3D=3D REQ_STATUS_RCVD) { + err =3D 0; + goto recalc_sigpending; + } + p9_debug(P9_DEBUG_MUX, "flushing\n"); sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); --=20 2.43.0 From nobody Sat Jul 25 16:18:26 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B66073B841D; Thu, 16 Jul 2026 07:31:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187105; cv=none; b=a53wyeWmanXAZz53SkmId+qvn0s1Hx4sLqwt8jRG6s9/1mS5wK+KPrGtPlAvUEFzVZTw2syw8p1Ss6fnX/srVWOlTUfno/xJ/x8ibM+CPGNRmfw2+examYwCzKRylGD0nodB2ueyl/v+w4evIoR7HKg2UIE+ZAWE3s3s/CbfjrE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187105; c=relaxed/simple; bh=MyByETTfMejsFg2h/7TBNRF1/JzJWW5gx3cnCd+bm6I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bNEJSzqkECO4ETVdu1SitpgO/IVA0QdSR1c9RKP9AHiJp1AcN8k2LjEZtg1odnkUqBqdzG3cYUI6Tmym2JR3LRDQ3jYje6HSuFDG7eKmCaD+ZjrFdm/S4zbbeZq31fr/LEZdD+teOIgSDj6JxR9NKAbbM8pcWclUY2PtZz+HltE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 620d7fbe80e811f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NO_NAME, HR_CTE_8B, HR_CTT_MISS HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME, HR_SJ_DIGIT_LEN HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM, HR_SJ_PHRASE HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_EXISTED, SN_UNTRUSTED SN_UNFAMILIAR, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU, AMN_GOOD ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:fa48a989-bdec-4bf6-9678-e5f6ac5a2b58,IP:10, URL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:-15 X-CID-INFO: VERSION:1.3.12,REQID:fa48a989-bdec-4bf6-9678-e5f6ac5a2b58,IP:10,UR L:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-15 X-CID-META: VersionHash:e7bac3a,CLOUDID:dca8558546fcef295ed8be98c05a617d,BulkI D:2607161531394NT1ASB1,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 620d7fbe80e811f1aa26b74ffac11d73-20260716 X-User: tanze@kylinos.cn Received: from desktop-od00ebi.localdomain [(116.128.244.169)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1490481796; Thu, 16 Jul 2026 15:31:39 +0800 From: Ze Tan To: ericvh@kernel.org, lucho@ionkov.net, asmadeus@codewreck.org, linux_oss@crudebyte.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, v9fs@lists.linux.dev, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, tanze@kylinos.cn Subject: [PATCH v2 2/3] net/9p: prepare fd transports for asynchronous aborts Date: Thu, 16 Jul 2026 15:30:50 +0800 Message-ID: <01635c2204d8181058bb808ff4b13df52df98a16.1784186316.git.tanze@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The fd transports keep their request reference while a sent request is on the receive list. That reference is released when a reply is consumed or when p9_conn_cancel() tears the connection down, so the caller can stop waiting without freeing the request or reusing its tag. Add an explicit transport capability and teach the fd reply path to consume replies for requests whose caller has aborted. Leave the capability disabled for transports with different request or DMA lifetime rules. Signed-off-by: Ze Tan --- include/net/9p/client.h | 3 +++ include/net/9p/transport.h | 4 ++++ net/9p/trans_fd.c | 10 +++++++++- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/include/net/9p/client.h b/include/net/9p/client.h index 55c6cb54bd25..700dcb37c1dc 100644 --- a/include/net/9p/client.h +++ b/include/net/9p/client.h @@ -58,6 +58,8 @@ enum p9_trans_status { * @REQ_STATUS_UNSENT: request waiting to be sent * @REQ_STATUS_SENT: request sent to server * @REQ_STATUS_RCVD: response received from server + * @REQ_STATUS_ABORTED: caller stopped waiting, but the request keeps its = tag + * reserved until a reply arrives or the transport cl= oses * @REQ_STATUS_FLSHD: request has been flushed * @REQ_STATUS_ERROR: request encountered an error on the client side */ @@ -67,6 +69,7 @@ enum p9_req_status_t { REQ_STATUS_UNSENT, REQ_STATUS_SENT, REQ_STATUS_RCVD, + REQ_STATUS_ABORTED, REQ_STATUS_FLSHD, REQ_STATUS_ERROR, }; diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h index a912bbaa862f..93349fe33dff 100644 --- a/include/net/9p/transport.h +++ b/include/net/9p/transport.h @@ -34,6 +34,9 @@ * @supports_vmalloc: set if this transport can work with vmalloc'd buffers * (non-physically contiguous memory). Transports requi= ring * DMA should leave this as false. + * @supports_async_abort: set if a sent request remains referenced by the + * transport until its reply is consumed or the + * transport is closed * @create: member function to create a new connection on this transport * @close: member function to discard a connection on this transport * @request: member function to issue a request to the transport @@ -55,6 +58,7 @@ struct p9_trans_module { bool pooled_rbuffers; bool def; /* this transport should be default */ bool supports_vmalloc; /* can work with vmalloc'd buffers */ + bool supports_async_abort; /* keeps sent requests alive after caller exit= s */ struct module *owner; int (*create)(struct p9_client *client, struct fs_context *fc); diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index eb685b52aeb2..d5cff8c2c88c 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -293,7 +293,9 @@ static void p9_read_work(struct work_struct *work) m, m->rc.size, m->rc.tag); =20 m->rreq =3D p9_tag_lookup(m->client, m->rc.tag); - if (!m->rreq || (m->rreq->status !=3D REQ_STATUS_SENT)) { + if (!m->rreq || + (m->rreq->status !=3D REQ_STATUS_SENT && + m->rreq->status !=3D REQ_STATUS_ABORTED)) { p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n", m->rc.tag); err =3D -EIO; @@ -332,6 +334,9 @@ static void p9_read_work(struct work_struct *work) if (m->rreq->status =3D=3D REQ_STATUS_SENT) { list_del(&m->rreq->req_list); p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD); + } else if (m->rreq->status =3D=3D REQ_STATUS_ABORTED) { + list_del(&m->rreq->req_list); + p9_client_cb(m->client, m->rreq, REQ_STATUS_ABORTED); } else if (m->rreq->status =3D=3D REQ_STATUS_FLSHD) { /* Ignore replies associated with a cancelled request. */ p9_debug(P9_DEBUG_TRANS, @@ -996,6 +1001,7 @@ static struct p9_trans_module p9_tcp_trans =3D { .pooled_rbuffers =3D false, .def =3D false, .supports_vmalloc =3D true, + .supports_async_abort =3D true, .create =3D p9_fd_create_tcp, .close =3D p9_fd_close, .request =3D p9_fd_request, @@ -1011,6 +1017,7 @@ static struct p9_trans_module p9_unix_trans =3D { .maxsize =3D MAX_SOCK_BUF, .def =3D false, .supports_vmalloc =3D true, + .supports_async_abort =3D true, .create =3D p9_fd_create_unix, .close =3D p9_fd_close, .request =3D p9_fd_request, @@ -1026,6 +1033,7 @@ static struct p9_trans_module p9_fd_trans =3D { .maxsize =3D MAX_SOCK_BUF, .def =3D false, .supports_vmalloc =3D true, + .supports_async_abort =3D true, .create =3D p9_fd_create, .close =3D p9_fd_close, .request =3D p9_fd_request, --=20 2.43.0 From nobody Sat Jul 25 16:18:26 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1E563B995E; Thu, 16 Jul 2026 07:31:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187108; cv=none; b=N+RNLhrf4gZmsHjLD0793u2bFGlLRsxhvDdhLXK1cWv18ZowZSbThYVpaEW7t9H9r1FS+KCXF/NSvkieXio1F9yYXbMGR5ZSrqh3a2U68u6GoarYtwr+q2KCp5WWoYw/qR/m0pUN/DpEi62eOi1eme4Ta0Td1SQPHZYVKJxR7uU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784187108; c=relaxed/simple; bh=wvOTet2COjQxObQt2JQi4y7BKSVg+1xPLpR5TuZYq+8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eSTjOFm2fwX+TjIMUmocrhZUTJi2LvasdjgwvMob6PTMBlzV9CRpfnLz+QwcDpKGUBB5dNnuUFM5FRVjKne7Xw0MT3jKzgz6vDMr8Gdp2CqslpQtzs7KsDAP6S49lODpklYrUH6jkepTW6WrgcvbBVQaMpMneKj8PkvwBSS0EN4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 6269a1c280e811f1aa26b74ffac11d73-20260716 X-CTIC-Tags: HR_CC_COUNT, HR_CC_DOMAIN_COUNT, HR_CC_NO_NAME, HR_CTE_8B, HR_CTT_MISS HR_DATE_H, HR_DATE_WKD, HR_DATE_ZONE, HR_FROM_NAME, HR_SJ_DIGIT_LEN HR_SJ_LANG, HR_SJ_LEN, HR_SJ_LETTER, HR_SJ_NOR_SYM, HR_SJ_PHRASE HR_SJ_PHRASE_LEN, HR_SJ_WS, HR_TO_COUNT, HR_TO_DOMAIN_COUNT, HR_TO_NO_NAME IP_TRUSTED, SRC_TRUSTED, DN_TRUSTED, SA_EXISTED, SN_UNTRUSTED SN_UNFAMILIAR, SPF_NOPASS, DKIM_NOPASS, DMARC_NOPASS, CIE_GOOD CIE_GOOD_SPF, GTI_FG_BS, GTI_RG_INFO, GTI_C_BU, AMN_GOOD ABX_MISS_RDNS X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:08c1430d-7250-42ec-9231-691bd82a05d5,IP:10, URL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:-15 X-CID-INFO: VERSION:1.3.12,REQID:08c1430d-7250-42ec-9231-691bd82a05d5,IP:10,UR L:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-15 X-CID-META: VersionHash:e7bac3a,CLOUDID:559c1f64010f1d2917c446ad2bb6711f,BulkI D:260716153142MPI5CV9J,BulkQuantity:0,Recheck:0,SF:10|38|66|78|81|82|102|1 27|865|898,TC:nil,Content:0|15|50,EDM:-3,IP:-2,URL:0,File:nil,RT:nil,Bulk: nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,B RE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 6269a1c280e811f1aa26b74ffac11d73-20260716 X-User: tanze@kylinos.cn Received: from desktop-od00ebi.localdomain [(116.128.244.169)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 2133234266; Thu, 16 Jul 2026 15:31:39 +0800 From: Ze Tan To: ericvh@kernel.org, lucho@ionkov.net, asmadeus@codewreck.org, linux_oss@crudebyte.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, v9fs@lists.linux.dev, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, tanze@kylinos.cn Subject: [PATCH v2 3/3] net/9p: abort interrupted fd RPCs on fatal signals Date: Thu, 16 Jul 2026 15:30:51 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzkaller reported a hung task while a thread group was dumping core. One thread was blocked in p9_client_rpc() on a 9p fd mount while another thread entered coredump_wait(). The coredump path sent a fatal signal to the blocked thread and waited for it to exit, but the 9p client sent TFLUSH and waited for an unresponsive server to acknowledge it. INFO: task syz.1.4497:22259 blocked for more than 143 seconds. Call trace: __switch_to __schedule schedule schedule_timeout __wait_for_common wait_for_completion_state vfs_coredump get_signal do_notify_resume Commit 6b4f48728faa ("net/9p: fix infinite loop in p9_client_rpc on fatal signal") stopped retrying an interrupted TFLUSH when a fatal signal is pending. The original non-flush RPC can still enter the TFLUSH path first, which needlessly depends on the server while the task is trying to exit. For transports that explicitly retain sent requests across an asynchronous abort, cancel unsent requests as usual and mark sent requests aborted without issuing TFLUSH. The fd receive or teardown path keeps the request and tag alive until it releases the transport reference. Do not enable this path for zero-copy RPCs or transports without the required lifetime guarantee. Fixes: 91b8534fa8f5 ("9p: make rpc code common and rework flush code") Signed-off-by: Ze Tan --- net/9p/client.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/net/9p/client.c b/net/9p/client.c index b9860ccb224b..47353cf0750d 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -538,6 +538,22 @@ static struct p9_req_t *p9_client_prepare_req(struct p= 9_client *c, return ERR_PTR(err); } =20 +static void p9_client_abort(struct p9_client *c, struct p9_req_t *req) +{ + /* + * A fatal signal cannot wait for TFLUSH, but a sent request must keep + * its tag until a late reply arrives or the transport is torn down. + */ + if (!c->trans_mod->supports_async_abort || + READ_ONCE(req->status) >=3D REQ_STATUS_RCVD) + return; + + if (!c->trans_mod->cancel(c, req)) + return; + + cmpxchg(&req->status, REQ_STATUS_SENT, REQ_STATUS_ABORTED); +} + /** * p9_client_rpc - issue a request and wait for a response * @c: client session @@ -617,6 +633,15 @@ p9_client_rpc(struct p9_client *c, int8_t type, const = char *fmt, ...) goto recalc_sigpending; } =20 + if (fatal_signal_pending(current) && + c->trans_mod->supports_async_abort) { + p9_debug(P9_DEBUG_MUX, "fatal signal: skip flush\n"); + p9_client_abort(c, req); + if (READ_ONCE(req->status) =3D=3D REQ_STATUS_RCVD) + err =3D 0; + goto recalc_sigpending; + } + p9_debug(P9_DEBUG_MUX, "flushing\n"); sigpending =3D 1; clear_thread_flag(TIF_SIGPENDING); --=20 2.43.0