Re: [syzbot] [v9fs?] KASAN: slab-use-after-free Read in p9_fid_destroy

From: asmadeus
Date: Thu May 23 2024 - 16:57:56 EST


David Howells wrote on Thu, May 23, 2024 at 07:07:05PM +0100:
> asmadeus@xxxxxxxxxxxxx wrote:
>
> > > There's a problem in 9p's interaction with netfslib whereby a crash occurs
> > > because the 9p_fid structs get forcibly destroyed during client teardown
> > > (without paying attention to their refcounts) before netfslib has finished
> > > with them. However, it's not a simple case of deferring the clunking that
> > > p9_fid_put() does as that requires the client.
> >
> > "as that requires the client" doesn't parse
>
> "... as that requires the p9_client record to still be present."?

Ah! yes, that works.
'as that uses/depends on the client' would also work.

Thanks,
--
Dominique Martinet | Asmadeus