tree ad307b27d11af6952e8494218d03a6c6171ec5ac
parent 72ea0321088df2c41eca8cc6160c24bcceb56ac7
author Dominique Martinet <dominique.martinet@cea.fr> 1539051532 +0900
committer Dominique Martinet <dominique.martinet@cea.fr> 1539130410 +0900

9p/trans_fd: abort p9_read_work if req status changed

p9_read_work would try to handle an errored req even if it got put to
error state by another thread between the lookup (that worked) and the
time it had been fully read.
The request itself is safe to use because we hold a ref to it from the
lookup (for m->rreq, so it was safe to read into the request data buffer
until this point), but the req_list has been deleted at the same time
status changed, and client_cb already has been called as well, so we
should not do either.

Link: http://lkml.kernel.org/r/1539057956-23741-1-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Reported-by: syzbot+2222c34dc40b515f30dc@syzkaller.appspotmail.com
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Latchesar Ionkov <lucho@ionkov.net>