All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Christian Brauner" <brauner@kernel.org>
Cc: linux-trace-kernel@vger.kernel.org, tytso@mit.edu,
	linux-ext4@vger.kernel.org
Subject: Re: [PATCH 3/8] 9p: free the session after a grace period
Date: Fri, 09 Oct 2026 22:03:59 +0000	[thread overview]
Message-ID: <sashiko-outbox-166122@kernel.org> (raw)
In-Reply-To: <20261009-work-fixes-rcu-v1-3-7446d2d335e6@kernel.org>

> v9fs_vfs_get_link_dotl() reads ->cache from the v9fs_session_info in
> sb->s_fs_info to decide whether the symlink target sits in the page
> cache. It does that before it looks at the dentry, so it also does it in
> rcu pathwalk mode. Without loose or metadata caching the dentries have
> no ->d_revalidate() that would make the walk leave rcu mode before it
> gets there.
> 
> v9fs_kill_super() frees the session and clears sb->s_fs_info without
> waiting for a grace period. Right now a pathwalk can't still be in
> v9fs_vfs_get_link_dotl() at that point, but only by accident. umount(2)
> waits for a grace period in namespace_unlock() before it drops the
> mount. And a mount whose last reference goes away elsewhere, like the
> chdir out of a lazily unmounted directory, still gets a grace period
> from bdi_unregister(). v9fs_fill_super() sets up a private bdi, so
> generic_shutdown_super() unregisters it from kill_anon_super() and
> bdi_remove_from_list() waits in synchronize_rcu_expedited() before
> v9fs_kill_super() frees the session. That grace period protects the rcu
> readers of bdi_list in the writeback code. It has nothing to do with
> pathwalk.
> 
> Don't rely on it. Keep sb->s_fs_info and free the session after a grace
> period.
> 
> Fixes: 712da38d134b ("9p: Enable symlink caching in page cache")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org?part=3


  reply	other threads:[~2026-10-09 22:04 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-09 21:51 [PATCH 0/8] fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees Christian Brauner
2026-10-09 21:51 ` [PATCH 1/8] ext4: free the sbi after a grace period Christian Brauner
2026-10-09 22:04   ` sashiko-bot
2026-10-13 12:14   ` Jan Kara
2026-10-09 21:51 ` [PATCH 2/8] afs: free the super info " Christian Brauner
2026-10-09 22:07   ` sashiko-bot
2026-10-10 12:54     ` Christian Brauner
2026-10-09 21:51 ` [PATCH 3/8] 9p: free the session " Christian Brauner
2026-10-09 22:03   ` sashiko-bot [this message]
2026-10-09 21:51 ` [PATCH 4/8] eventfs: free the eventfs_inode after an rcu grace period too Christian Brauner
2026-10-09 21:58   ` sashiko-bot
2026-10-09 21:51 ` [PATCH 5/8] ipc: drop the mqueue mount with kern_unmount() on setup failure Christian Brauner
2026-10-09 22:00   ` sashiko-bot
2026-10-09 21:51 ` [PATCH 6/8] unicode: free the map after a grace period Christian Brauner
2026-10-09 22:04   ` sashiko-bot
2026-10-13 12:16   ` Jan Kara
2026-10-13 17:35   ` Gabriel Krisman Bertazi
2026-10-09 21:51 ` [PATCH 7/8] ntfs3: free the sbi " Christian Brauner
2026-10-09 22:03   ` sashiko-bot
2026-10-09 21:51 ` [PATCH 8/8] ntfs3: free replaced mount options " Christian Brauner
2026-10-09 22:02   ` sashiko-bot
2026-10-10 12:55     ` Christian Brauner
2026-10-12 10:36 ` [PATCH 0/8] fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees Jan Kara
2026-10-12 10:42   ` Christian Brauner
2026-10-13 10:47     ` Jan Kara
2026-10-13 19:23       ` Christian Brauner
2026-10-13 19:25         ` Christian Brauner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-166122@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=brauner@kernel.org \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.