Re: [PATCH] 9p: pin request under client lock in p9_tag_lookup

[Dominique Martinet <asmadeus@codewreck.org>]

Jérémy Jean wrote on Wed, Sep 30, 2026 at 08:13:58PM +0000:
> 9P clients keep separate request tables but share one request cache.
> p9_tag_lookup() can race with the final p9_req_put() and pin a request

Ah.. Right, just checking the tag isn't enough, we also need to check
the client... I'm not sure why I had assumed the caches were not merged,
they're only not merged with different types..

So technically we could add a reference or some kind of id for the
client and check that, but given SLAB_TYPESAFE_BY_RCU is hard to grok I
guess it's much simpler to just take the lock and be done with it...
(in that case we can get rid of SLAB_TYPESAFE_BY_RCU altogether, the
lock is enough guarantee that the memory is valid until we get the ref
here)

It's far from a new bug so I'd rather not rush this just to go back to
rcu a few weeks later, give me a bit of time to check how much impact
taking the lock here adds so we can decide. There's enough leeway in the
p9_req_t struct that we can check the client for free if we care...

Meanwhile, if someone else has an opinon feel free to chip in
-- 
Dominique Martinet | Asmadeus