Re: [PATCH] 9p: reject RERROR/RLERROR with zero errcode and guard 0-link drop_nlink()

[Dominique Martinet]

Hui Peng wrote on Sat, Sep 19, 2026 at 10:17:34PM +0000:
> Fix two issues in 9p client and VFS inode handling:

Please split this in two commits.

> 1. In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p
>    server returning P9_RERROR or P9_RLERROR with ecode == 0 causes
>    p9_check_errors() to return 0 (success) while leaving the unparsed
>    response payload as if the expected reply message type succeeded. Map
>    ecode == 0 on RERROR / RLERROR to -EPROTO.

Sure

> 2. In v9fs_dec_count() (fs/9p/vfs_inode.c), only call drop_nlink() when
>    inode->i_nlink > 0 so unlinking an inode whose server-reported nlink
>    was already 0 does not underflow i_nlink and trigger
>    WARN_ON(inode->i_nlink == 0).

I'm pretty sure this is racy but the dir case already is anyway, so meh,
why not, ok.

-- 
Dominique Martinet | Asmadeus