[PATCH] 9p: do not store the create fid on special files

[PATCH] 9p: do not store the create fid on special files

[Yuanfu Xie]

v9fs_vfs_atomic_open_dotl() always stores the create fid in
file->private_data after finish_open().  FIFO and device inodes
already have type-specific file_operations that own that field.
Overwriting it with the fid makes later read/write/close treat the
p9_fid as a pipe_inode_info, which corrupts the fid and can use it
after it has been clunked.  The non-dotl atomic_open path does not
assign the fid this way.

Only attach the fid for regular files and directories.  Special
files do not need the create fid; leave it for the existing
p9_fid_put() on the out path so it is clunked before return.

KASAN report, linux-stable 4982d3552a3b:

BUG: KASAN: slab-use-after-free in anon_pipe_prefill_and_lock+0x376/0x3f0
Read of size 4 at addr ffff88800ab30538 by task repro/1

Call Trace:
 <TASK>
 anon_pipe_prefill_and_lock+0x376/0x3f0
 anon_pipe_write+0x127/0x1600
 fifo_pipe_write+0x24/0x300
 vfs_write+0x659/0xd00
 ksys_write+0x10f/0x200
 do_syscall_64+0xdd/0x4a0
 </TASK>

Fixes: 30d904947459 ("kill struct opendata")
Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>

---
The private_data guard was boot-tested on a 9P2000.L mount: a write
to a FIFO reached a reader again, and regular-file I/O stayed clean.
Without the guard the same write returned success but the reader
saw nothing.  Skipping v9fs_open_fid_add() for special files is so
the unused create fid is clunked by the existing put on the out
path; that part is compile-checked on 4982d3552a3b.

 fs/9p/vfs_inode_dotl.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 116b29e95f21e..ff5b21e956b12 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -316,16 +316,24 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
 	err = finish_open(file, dentry, generic_file_open);
 	if (err)
 		goto out;
-	file->private_data = ofid;
+	/*
+	 * Special files have type-specific fops that own
+	 * file->private_data.  The create fid is unused
+	 * there: leave it for p9_fid_put() on the out
+	 * path so it is clunked before we return.
+	 */
+	if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) {
+		file->private_data = ofid;
 #ifdef CONFIG_9P_FSCACHE
-	if (v9ses->cache & CACHE_FSCACHE) {
-		struct v9fs_inode *v9inode = V9FS_I(inode);
-		fscache_use_cookie(v9fs_inode_cookie(v9inode),
-				   file->f_mode & FMODE_WRITE);
-	}
+		if (v9ses->cache & CACHE_FSCACHE) {
+			struct v9fs_inode *v9inode = V9FS_I(inode);
+			fscache_use_cookie(v9fs_inode_cookie(v9inode),
+					   file->f_mode & FMODE_WRITE);
+		}
 #endif
-	v9fs_fid_add_modes(ofid, v9ses->flags, v9ses->cache, flags);
-	v9fs_open_fid_add(inode, &ofid);
+		v9fs_fid_add_modes(ofid, v9ses->flags, v9ses->cache, flags);
+		v9fs_open_fid_add(inode, &ofid);
+	}
 	file->f_mode |= FMODE_CREATED;
 out:
 	p9_fid_put(dfid);

Re: [PATCH] 9p: do not store the create fid on special files

[Dominique Martinet]

Yuanfu Xie wrote on Tue, Sep 22, 2026 at 09:16:22PM +0800:
> v9fs_vfs_atomic_open_dotl() always stores the create fid in
> file->private_data after finish_open().  FIFO and device inodes
> already have type-specific file_operations that own that field.
> Overwriting it with the fid makes later read/write/close treat the
> p9_fid as a pipe_inode_info, which corrupts the fid and can use it
> after it has been clunked.  The non-dotl atomic_open path does not
> assign the fid this way.
> 
> Only attach the fid for regular files and directories.  Special
> files do not need the create fid; leave it for the existing
> p9_fid_put() on the out path so it is clunked before return.
> 
> KASAN report, linux-stable 4982d3552a3b:
> 
> BUG: KASAN: slab-use-after-free in anon_pipe_prefill_and_lock+0x376/0x3f0
> Read of size 4 at addr ffff88800ab30538 by task repro/1
> 
> Call Trace:
>  <TASK>
>  anon_pipe_prefill_and_lock+0x376/0x3f0
>  anon_pipe_write+0x127/0x1600
>  fifo_pipe_write+0x24/0x300
>  vfs_write+0x659/0xd00
>  ksys_write+0x10f/0x200
>  do_syscall_64+0xdd/0x4a0
>  </TASK>
> 
> Fixes: 30d904947459 ("kill struct opendata")
> Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>

Thanks, also picked up

-- 
Dominique Martinet | Asmadeus