Re: [syzbot] [netfs?] INFO: task hung in netfs_unbuffered_write_iter

[K Prateek Nayak]

Hello Dominique,

On 3/28/2025 3:48 AM, asmadeus@xxxxxxxxxxxxx wrote:
> syzbot wrote on Thu, Mar 27, 2025 at 02:19:03PM -0700:
> > BUG: KASAN: slab-use-after-free in p9_conn_cancel+0x900/0x910 net/9p/trans_fd.c:205
> > Read of size 8 at addr ffff88807b19ea50 by task syz-executor/6595

Woops! Should have tested with KASAN enabled. This time I did.

> Ugh, why...
> Ah, if ->request() fails p9_client_rpc assumes the request was not
> written (e.g. write error), so you can't return an error after the
> list_add_tail call in p9_fd_request.
>
> I think you can call p9_conn_cancel with the error and return 0 anyway,
> and this paticular workaround will probably work, regardless of whether
> it's the correct thing to do here (still haven't had time to look at the
> patch here)

That works too! Thank you for the pointer.

> Sorry for this mess (even if most of it predates me...)

And I'm sorry for the noise from hacking on stuff that I don't fully
understand.

Fingers crossed (and thank you syzbot)

#syz test: upstream aaec5a95d59615523db03dd53c2052f0a87beea7

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 196060dc6138..dab7f02dc243 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -687,7 +687,13 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
 	else
 		n = p9_fd_poll(m->client, NULL, NULL);
 
-	if (n & EPOLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
+	/* Failed to send request */
+	if (!(n & EPOLLOUT)) {
+		p9_conn_cancel(m, -EIO);
+		return 0;
+	}
+
+	if (!test_and_set_bit(Wworksched, &m->wsched))
 		schedule_work(&m->wq);
 
 	return 0;