Re: [PATCH] net/9p/usbg: Fix use-after-free on usb9pfs_clear_tx

[Michael Grzeschik <mgr@kernel.org>]

Hi Dominique

On Sun, Sep 13, 2026 at 05:44:34PM +0900, Dominique Martinet wrote:
> I'm honestly not quite sure what to do with this and others UAF usb9pfs
> patches -- you acked the first one I replied to, and the tag match is
> obviously correct so I picked these two, but I'd like your opinion on
> the rest for two reasons:
>  - There seem to be plenty of rough edges around usb9pfs, and frankly I
> don't consider this a trust boundary (the usecase being developping
> embedded devices, you trust the server fully, so whatever happens
> in corner cases doesn't matter)

I agree that the edges are there and need to be fixed.

>  - You had a rework in progress (before leaving Pengutronix, which I can
>  totally understand you don't have time or want to keep carrying going
>  forward, but is someone else from Pengutronix taking your place?)

I am actually carrying to improve the series. I just now got some time
and started to build an setup where I can easily test further changes.

Also my leftover patches are also tested and ready for updates on the
list.

> For all I know this is also correct, but I'm not sure slapping a bandaid
> is the way to go, so I'd really appreciate if you could have a look at
> this[1] and "net/9p/usbg: clear stale request context after abort"[2]
> [1] https://lore.kernel.org/r/20260529081026.77732-1-zhaoyz24@mails.tsinghua.edu.cn
> [2] https://lore.kernel.org/r/20260802152148.810390-1-marsy12010123@gmail.com
> 
> If you tell me to pick them up I will, and if I don't hear back from you
> I'll take another look hopefully before the 7.4 deadline, but I honestly
> don't have enough time for this so the most likely outcome will be
> /dev/null

I just acked the two and rebased my further work on them.

> Thanks (and sorry Yizhou Zhao / Chengfeng Ye)

Thank you for caring and sorry for the long delay. Things are in
steady motion, but will hopefully smooth out soon. ;)

> -- 
> Dominique