Re: [PATCH] net/9p/usbg: Fix use-after-free on usb9pfs_clear_tx

[Dominique Martinet]

Hi Michael,

I'm honestly not quite sure what to do with this and others UAF usb9pfs
patches -- you acked the first one I replied to, and the tag match is
obviously correct so I picked these two, but I'd like your opinion on
the rest for two reasons:
 - There seem to be plenty of rough edges around usb9pfs, and frankly I
don't consider this a trust boundary (the usecase being developping
embedded devices, you trust the server fully, so whatever happens
in corner cases doesn't matter)
 - You had a rework in progress (before leaving Pengutronix, which I can
 totally understand you don't have time or want to keep carrying going
 forward, but is someone else from Pengutronix taking your place?)

For all I know this is also correct, but I'm not sure slapping a bandaid
is the way to go, so I'd really appreciate if you could have a look at
this[1] and "net/9p/usbg: clear stale request context after abort"[2]
[1] https://lore.kernel.org/r/20260529081026.77732-1-zhaoyz24@xxxxxxxxxxxxxxxxxxxxx
[2] https://lore.kernel.org/r/20260802152148.810390-1-marsy12010123@xxxxxxxxx

If you tell me to pick them up I will, and if I don't hear back from you
I'll take another look hopefully before the 7.4 deadline, but I honestly
don't have enough time for this so the most likely outcome will be
/dev/null

Thanks (and sorry Yizhou Zhao / Chengfeng Ye)
-- 
Dominique