* [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
@ 2026-07-25 1:44 Deepanshu Kartikey
2026-08-06 8:25 ` Deepanshu Kartikey
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Deepanshu Kartikey @ 2026-07-25 1:44 UTC (permalink / raw)
To: ericvh, lucho, asmadeus, linux_oss
Cc: v9fs, linux-kernel, Deepanshu Kartikey, syzbot+344c09c64fcd8d3d2782
v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
symlink read via the page cache. This is a benign TOCTOU race: a
concurrent unlink()/rename() can remove the target between the walk
finding the dentry and p9_client_walk() completing, so the lookup
legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
With panic_on_warn=1, this WARN escalates to a full kernel panic --
an unprivileged local DoS reachable by racing mount() against a
concurrent unlink/rename.
Return the error directly instead of WARN_ONCE().
Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/9p/vfs_addr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index 1ac0b3dcc077..121679488ab9 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -140,13 +140,16 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
goto no_fid;
p9_fid_get(fid);
} else if (S_ISLNK(rreq->inode->i_mode)) {
+ /* racing unlink/rename can make this fail with -ENOENT;
+ * that's expected, not a kernel bug, so don't WARN
+ */
dentry = d_find_any_alias(rreq->inode);
if (!dentry)
goto no_fid;
fid = v9fs_fid_lookup(dentry);
dput(dentry);
if (IS_ERR(fid))
- goto no_fid;
+ return PTR_ERR(fid);
} else {
fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
if (!fid)
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
2026-07-25 1:44 [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure Deepanshu Kartikey
@ 2026-08-06 8:25 ` Deepanshu Kartikey
2026-08-21 1:49 ` Deepanshu Kartikey
2026-09-13 13:33 ` Dominique Martinet
2 siblings, 0 replies; 4+ messages in thread
From: Deepanshu Kartikey @ 2026-08-06 8:25 UTC (permalink / raw)
To: ericvh, lucho, asmadeus, linux_oss
Cc: v9fs, linux-kernel, syzbot+344c09c64fcd8d3d2782
On Sat, Jul 25, 2026 at 7:14 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
> symlink read via the page cache. This is a benign TOCTOU race: a
> concurrent unlink()/rename() can remove the target between the walk
> finding the dentry and p9_client_walk() completing, so the lookup
> legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
>
> With panic_on_warn=1, this WARN escalates to a full kernel panic --
> an unprivileged local DoS reachable by racing mount() against a
> concurrent unlink/rename.
>
> Return the error directly instead of WARN_ONCE().
>
> Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> fs/9p/vfs_addr.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
> index 1ac0b3dcc077..121679488ab9 100644
> --- a/fs/9p/vfs_addr.c
> +++ b/fs/9p/vfs_addr.c
> @@ -140,13 +140,16 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
> goto no_fid;
> p9_fid_get(fid);
> } else if (S_ISLNK(rreq->inode->i_mode)) {
> + /* racing unlink/rename can make this fail with -ENOENT;
> + * that's expected, not a kernel bug, so don't WARN
> + */
> dentry = d_find_any_alias(rreq->inode);
> if (!dentry)
> goto no_fid;
> fid = v9fs_fid_lookup(dentry);
> dput(dentry);
> if (IS_ERR(fid))
> - goto no_fid;
> + return PTR_ERR(fid);
> } else {
> fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
> if (!fid)
> --
> 2.43.0
>
Gentle Reminder. Let me know anythng else needed from my side.
Thanks
Deepanshu
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
2026-07-25 1:44 [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure Deepanshu Kartikey
2026-08-06 8:25 ` Deepanshu Kartikey
@ 2026-08-21 1:49 ` Deepanshu Kartikey
2026-09-13 13:33 ` Dominique Martinet
2 siblings, 0 replies; 4+ messages in thread
From: Deepanshu Kartikey @ 2026-08-21 1:49 UTC (permalink / raw)
To: ericvh, lucho, asmadeus, linux_oss
Cc: v9fs, linux-kernel, syzbot+344c09c64fcd8d3d2782
On Sat, Jul 25, 2026 at 7:14 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
> symlink read via the page cache. This is a benign TOCTOU race: a
> concurrent unlink()/rename() can remove the target between the walk
> finding the dentry and p9_client_walk() completing, so the lookup
> legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
>
> With panic_on_warn=1, this WARN escalates to a full kernel panic --
> an unprivileged local DoS reachable by racing mount() against a
> concurrent unlink/rename.
>
> Return the error directly instead of WARN_ONCE().
>
> Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> fs/9p/vfs_addr.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
> index 1ac0b3dcc077..121679488ab9 100644
> --- a/fs/9p/vfs_addr.c
> +++ b/fs/9p/vfs_addr.c
> @@ -140,13 +140,16 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
> goto no_fid;
> p9_fid_get(fid);
> } else if (S_ISLNK(rreq->inode->i_mode)) {
> + /* racing unlink/rename can make this fail with -ENOENT;
> + * that's expected, not a kernel bug, so don't WARN
> + */
> dentry = d_find_any_alias(rreq->inode);
> if (!dentry)
> goto no_fid;
> fid = v9fs_fid_lookup(dentry);
> dput(dentry);
> if (IS_ERR(fid))
> - goto no_fid;
> + return PTR_ERR(fid);
> } else {
> fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
> if (!fid)
> --
> 2.43.0
>
Gentle Reminder. Let me know anythng else needed from my side.
Thanks
Deepanshu
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
2026-07-25 1:44 [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure Deepanshu Kartikey
2026-08-06 8:25 ` Deepanshu Kartikey
2026-08-21 1:49 ` Deepanshu Kartikey
@ 2026-09-13 13:33 ` Dominique Martinet
2 siblings, 0 replies; 4+ messages in thread
From: Dominique Martinet @ 2026-09-13 13:33 UTC (permalink / raw)
To: Deepanshu Kartikey
Cc: ericvh, lucho, linux_oss, v9fs, linux-kernel,
syzbot+344c09c64fcd8d3d2782
Deepanshu Kartikey wrote on Sat, Jul 25, 2026 at 07:14:48AM +0530:
> v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
> symlink read via the page cache. This is a benign TOCTOU race: a
> concurrent unlink()/rename() can remove the target between the walk
> finding the dentry and p9_client_walk() completing, so the lookup
> legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
>
> With panic_on_warn=1, this WARN escalates to a full kernel panic --
> an unprivileged local DoS reachable by racing mount() against a
> concurrent unlink/rename.
>
> Return the error directly instead of WARN_ONCE().
>
> Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Fair enough, picked up for 7.4
--
Dominique Martinet | Asmadeus
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-13 13:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-25 1:44 [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure Deepanshu Kartikey
2026-08-06 8:25 ` Deepanshu Kartikey
2026-08-21 1:49 ` Deepanshu Kartikey
2026-09-13 13:33 ` Dominique Martinet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®