Re: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure

[Dominique Martinet]

Deepanshu Kartikey wrote on Sat, Jul 25, 2026 at 07:14:48AM +0530:
> v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
> symlink read via the page cache. This is a benign TOCTOU race: a
> concurrent unlink()/rename() can remove the target between the walk
> finding the dentry and p9_client_walk() completing, so the lookup
> legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
> 
> With panic_on_warn=1, this WARN escalates to a full kernel panic --
> an unprivileged local DoS reachable by racing mount() against a
> concurrent unlink/rename.
> 
> Return the error directly instead of WARN_ONCE().
> 
> Reported-by: syzbot+344c09c64fcd8d3d2782@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>

Fair enough, picked up for 7.4
-- 
Dominique Martinet | Asmadeus