* Forwarded: [PATCH] 9p: add DIAG WARN_ONCE sites to disambiguate v9fs_init_request no_fid failures
2026-07-24 5:26 [syzbot] [v9fs?] WARNING in v9fs_init_request (2) syzbot
@ 2026-07-24 11:53 ` syzbot
2026-07-24 23:41 ` Forwarded: [PATCH] 9p: add printk diagnostics to identify -ENOENT source in v9fs_fid_lookup syzbot
2026-07-25 1:41 ` Forwarded: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure syzbot
2 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2026-07-24 11:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] 9p: add DIAG WARN_ONCE sites to disambiguate v9fs_init_request no_fid failures
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
v9fs_init_request() funnels four different failure modes into a
single shared WARN_ONCE("folio expected an open fid ...") message,
making it impossible to tell from a crash report which one actually
fired. Split each site out with its own message (and the errno for
the v9fs_fid_lookup() case) to identify the exact cause of the
syzbot-reported "WARNING in v9fs_init_request (2)".
Diagnostic only, not a functional fix.
Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/9p/vfs_addr.c | 37 ++++++++++++++++++++++++-------------
1 file changed, 24 insertions(+), 13 deletions(-)
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index 1ac0b3dcc077..fc05bd963506 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -136,21 +136,37 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
if (file) {
fid = file->private_data;
- if (!fid)
- goto no_fid;
+ if (!fid) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: file has no fid, "
+ "inode->i_ino=%llx\n", rreq->inode->i_ino);
+ return -EINVAL;
+ }
p9_fid_get(fid);
} else if (S_ISLNK(rreq->inode->i_mode)) {
dentry = d_find_any_alias(rreq->inode);
- if (!dentry)
- goto no_fid;
+ if (!dentry) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: symlink inode has no "
+ "dentry alias, inode->i_ino=%llx\n",
+ rreq->inode->i_ino);
+ return -EINVAL;
+ }
fid = v9fs_fid_lookup(dentry);
+ if (IS_ERR(fid)) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: v9fs_fid_lookup failed "
+ "for symlink, err=%ld dentry=%pd4 inode->i_ino=%llx\n",
+ PTR_ERR(fid), dentry, rreq->inode->i_ino);
+ dput(dentry);
+ return PTR_ERR(fid);
+ }
dput(dentry);
- if (IS_ERR(fid))
- goto no_fid;
} else {
fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
- if (!fid)
- goto no_fid;
+ if (!fid) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: non-symlink inode has "
+ "no open/writeback fid, inode->i_ino=%llx\n",
+ rreq->inode->i_ino);
+ return -EINVAL;
+ }
}
rreq->wsize = fid->clnt->msize - P9_IOHDRSZ;
@@ -163,11 +179,6 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
WARN_ON(rreq->origin == NETFS_READ_FOR_WRITE && !(fid->mode & P9_ORDWR));
rreq->netfs_priv = fid;
return 0;
-
-no_fid:
- WARN_ONCE(1, "folio expected an open fid inode->i_ino=%llx\n",
- rreq->inode->i_ino);
- return -EINVAL;
}
/**
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Forwarded: [PATCH] 9p: add printk diagnostics to identify -ENOENT source in v9fs_fid_lookup
2026-07-24 5:26 [syzbot] [v9fs?] WARNING in v9fs_init_request (2) syzbot
2026-07-24 11:53 ` Forwarded: [PATCH] 9p: add DIAG WARN_ONCE sites to disambiguate v9fs_init_request no_fid failures syzbot
@ 2026-07-24 23:41 ` syzbot
2026-07-25 1:41 ` Forwarded: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure syzbot
2 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2026-07-24 23:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] 9p: add printk diagnostics to identify -ENOENT source in v9fs_fid_lookup
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add printk(KERN_WARNING) at the three points in
v9fs_fid_lookup_with_uid() where a racing unlink/rename can cause a
symlink fid walk to fail, to determine which one produces the
-ENOENT seen in the "WARNING in v9fs_init_request (2)" reproducer.
Diagnostic only, not a functional fix.
Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/9p/fid.c | 10 ++++++++++
fs/9p/vfs_addr.c | 37 ++++++++++++++++++++++++-------------
2 files changed, 34 insertions(+), 13 deletions(-)
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 76242d450aa7..d8d79a4c88ef 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -194,6 +194,10 @@ static struct p9_fid *v9fs_fid_lookup_with_uid(struct dentry *dentry,
old_fid = fid;
fid = p9_client_walk(old_fid, 1, &dentry->d_name.name, 1);
+ if (IS_ERR(fid)) {
+ printk(KERN_WARNING "DIAG: single-component p9_client_walk "
+ "failed, name=%pd err=%ld\n", dentry, PTR_ERR(fid));
+ }
p9_fid_put(old_fid);
goto fid_out;
}
@@ -251,6 +255,9 @@ static struct p9_fid *v9fs_fid_lookup_with_uid(struct dentry *dentry,
old_fid = fid;
}
if (IS_ERR(fid)) {
+ printk(KERN_WARNING "DIAG: multipath p9_client_walk failed, "
+ "name=%pd component_index=%d err=%ld\n",
+ dentry, i, PTR_ERR(fid));
kfree(wnames);
goto err_out;
}
@@ -262,6 +269,9 @@ static struct p9_fid *v9fs_fid_lookup_with_uid(struct dentry *dentry,
spin_lock(&dentry->d_lock);
if (d_unhashed(dentry)) {
spin_unlock(&dentry->d_lock);
+ printk(KERN_WARNING "DIAG: walk succeeded but dentry "
+ "unhashed, manufacturing -ENOENT, name=%pd\n",
+ dentry);
p9_fid_put(fid);
fid = ERR_PTR(-ENOENT);
} else {
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index 1ac0b3dcc077..fc05bd963506 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -136,21 +136,37 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
if (file) {
fid = file->private_data;
- if (!fid)
- goto no_fid;
+ if (!fid) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: file has no fid, "
+ "inode->i_ino=%llx\n", rreq->inode->i_ino);
+ return -EINVAL;
+ }
p9_fid_get(fid);
} else if (S_ISLNK(rreq->inode->i_mode)) {
dentry = d_find_any_alias(rreq->inode);
- if (!dentry)
- goto no_fid;
+ if (!dentry) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: symlink inode has no "
+ "dentry alias, inode->i_ino=%llx\n",
+ rreq->inode->i_ino);
+ return -EINVAL;
+ }
fid = v9fs_fid_lookup(dentry);
+ if (IS_ERR(fid)) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: v9fs_fid_lookup failed "
+ "for symlink, err=%ld dentry=%pd4 inode->i_ino=%llx\n",
+ PTR_ERR(fid), dentry, rreq->inode->i_ino);
+ dput(dentry);
+ return PTR_ERR(fid);
+ }
dput(dentry);
- if (IS_ERR(fid))
- goto no_fid;
} else {
fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
- if (!fid)
- goto no_fid;
+ if (!fid) {
+ WARN_ONCE(1, "DIAG: v9fs_init_request: non-symlink inode has "
+ "no open/writeback fid, inode->i_ino=%llx\n",
+ rreq->inode->i_ino);
+ return -EINVAL;
+ }
}
rreq->wsize = fid->clnt->msize - P9_IOHDRSZ;
@@ -163,11 +179,6 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
WARN_ON(rreq->origin == NETFS_READ_FOR_WRITE && !(fid->mode & P9_ORDWR));
rreq->netfs_priv = fid;
return 0;
-
-no_fid:
- WARN_ONCE(1, "folio expected an open fid inode->i_ino=%llx\n",
- rreq->inode->i_ino);
- return -EINVAL;
}
/**
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Forwarded: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
2026-07-24 5:26 [syzbot] [v9fs?] WARNING in v9fs_init_request (2) syzbot
2026-07-24 11:53 ` Forwarded: [PATCH] 9p: add DIAG WARN_ONCE sites to disambiguate v9fs_init_request no_fid failures syzbot
2026-07-24 23:41 ` Forwarded: [PATCH] 9p: add printk diagnostics to identify -ENOENT source in v9fs_fid_lookup syzbot
@ 2026-07-25 1:41 ` syzbot
2 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2026-07-25 1:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] 9p: don't WARN_ONCE on racy symlink fid lookup failure
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
v9fs_init_request() WARN_ONCE()s when v9fs_fid_lookup() fails for a
symlink read via the page cache. This is a benign TOCTOU race: a
concurrent unlink()/rename() can remove the target between the walk
finding the dentry and p9_client_walk() completing, so the lookup
legitimately fails with -ENOENT (observed: dentry=/file0, err=-2).
With panic_on_warn=1, this WARN escalates to a full kernel panic --
an unprivileged local DoS reachable by racing mount() against a
concurrent unlink/rename.
Return the error directly instead of WARN_ONCE().
Reported-by: syzbot+344c09c64fcd8d3d2782@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=344c09c64fcd8d3d2782
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/9p/vfs_addr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index 1ac0b3dcc077..121679488ab9 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -140,13 +140,16 @@ static int v9fs_init_request(struct netfs_io_request *rreq, struct file *file)
goto no_fid;
p9_fid_get(fid);
} else if (S_ISLNK(rreq->inode->i_mode)) {
+ /* racing unlink/rename can make this fail with -ENOENT;
+ * that's expected, not a kernel bug, so don't WARN
+ */
dentry = d_find_any_alias(rreq->inode);
if (!dentry)
goto no_fid;
fid = v9fs_fid_lookup(dentry);
dput(dentry);
if (IS_ERR(fid))
- goto no_fid;
+ return PTR_ERR(fid);
} else {
fid = v9fs_fid_find_inode(rreq->inode, writing, INVALID_UID, true);
if (!fid)
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread