Re: [PATCH] netfs: Fix UAF in netfs_unbuffered_write() on failed preparation

[ChenXiaoSong]

Hi David and hongao,

Please refer to my blog for the tracing log and reproduction steps:
https://chenxiaosong.com/en/netfs-uaf-in-netfs_unbuffered_write.html (I 
will make sure this link is always accessible)

I would appreciate it if you could continue debugging and fixing this 
issue. As I have many SMB features to implement and review tasks to do.

On 6/24/26 00:10, David Howells wrote:
> ChenXiaoSong <chenxiaosong@xxxxxxxxxxxxxxxx> wrote:
>
> > After applying this patch, I can still reproduce the use-after-free issue.
>
> Can you get some tracing?  I have a suspicion it's a refcount bug.
>
> The following tracepoints would be useful:
>
> echo 1 > /sys/kernel/tracing/events/netfs/netfs_read/enable
> echo 1 > /sys/kernel/tracing/events/netfs/netfs_write/enable
> echo 1 > /sys/kernel/tracing/events/netfs/netfs_rreq/enable
> echo 1 > /sys/kernel/tracing/events/netfs/netfs_sreq/enable
> echo 1 > /sys/kernel/tracing/events/netfs/netfs_failure/enable
> echo 1 > /sys/kernel/tracing/events/error_report/enable
>
> And if you can capture this, can you compress the resulting trace and send it
> to me?
>
> Thanks,
> David

--
ChenXiaoSong <chenxiaosong@xxxxxxxxxxxxxxxx>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en