[BUG] afs_done_fs_inline_bulk_status -- KASAN null-ptr-deref on call->server when a fileserver aborts FS.InlineBulkStatus

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/134-afs-null-call-server-inline-bulk-status/

  BUG: KASAN: null-ptr-deref in afs_done_fs_inline_bulk_status+0xb4/0x180
  Write of size 8 at addr 00000000000001a8 by task repro/9497
  Call Trace:
   afs_done_fs_inline_bulk_status+0xb4/0x180
   afs_deliver_to_call+0xbf6/0xfc0
   afs_wait_for_call_to_complete+0x2de/0xb00
   afs_wait_for_operation+0x244/0x8d0
   afs_lookup+0x1245/0x1700
   __lookup_slow+0x1fb/0x2f0
   lookup_slow+0x53/0x70
   path_lookupat+0x3f5/0x8c0
   filename_lookup+0x256/0x5d0
   vfs_statx+0xfc/0x200
   vfs_fstatat+0x11b/0x170
   __x64_sys_newfstatat+0x151/0x200
  Kernel panic - not syncing: KASAN: panic_on_warn set ...

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,