diff options
| author | Deepanshu Kartikey <kartikey406@gmail.com> | 2026-07-25 07:14:48 +0530 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2026-09-22 08:07:33 +0000 |
| commit | 64f350a594f97afd590a278f4c4d9c1e99092f14 (patch) | |
| tree | 09fd0d44e9c54beeb9257015bde56ba28a1bb654 /scripts/basic/split-include.c | |
| parent | 2acd800de8827b7cdce8cb5c2c63b8e8608ec8e3 (diff) | |
| download | linux-64f350a594f97afd590a278f4c4d9c1e99092f14.tar.gz linux-64f350a594f97afd590a278f4c4d9c1e99092f14.zip | |
9p: don't WARN_ONCE on racy symlink fid lookup failure
v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
symlink read via the page cache. This is a benign TOCTOU race: a
concurrent unlink()/rename() can remove the target between the walk
finding the dentry and p9_client_walk() completing, so the lookup
legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
With panic_on_warn=1, this WARN escalates to a full kernel panic --
an unprivileged local DoS reachable by racing mount() against a
concurrent unlink/rename.
Return the error directly instead of WARN_ONCE().
Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Message-ID: <20260725014448.18711-1-kartikey406@gmail.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions