Re: [syzbot] [v9fs?] general protection fault in p9_client_walk

[asmadeus@codewreck.org]

Christian Schoenebeck wrote on Wed, Mar 12, 2025 at 10:36:15AM +0100:
> > RIP: 0010:p9_client_walk+0x9a/0x530 net/9p/client.c:1165
> >  clone_fid fs/9p/fid.h:23 [inline]
> >  v9fs_fid_xattr_set+0x119/0x2d0 fs/9p/xattr.c:121
> >  v9fs_set_acl+0xe6/0x150 fs/9p/acl.c:276
> >  v9fs_set_create_acl+0x4b/0x70 fs/9p/acl.c:306
> >  v9fs_vfs_mkdir_dotl+0x517/0x6e0 fs/9p/vfs_inode_dotl.c:411
> >  vfs_mkdir+0x57d/0x860 fs/namei.c:4313
> >  do_mkdirat+0x301/0x3a0 fs/namei.c:4336
> >  __do_sys_mkdir fs/namei.c:4356 [inline]
> >  __se_sys_mkdir fs/namei.c:4354 [inline]
> >  __x64_sys_mkdir+0xef/0x140 fs/namei.c:4354
> >  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> >  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
> >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Just had a glimpse on it so far. IIUIC the trigger is in
> v9fs_vfs_mkdir_dotl() [fs/9p/vfs_inode_dotl.c:411] ?
> 
>     // NULLs out fid (since dafbe6897)
>     v9fs_fid_add(dentry, &fid);
>     // expects fid being non-NULL
>     v9fs_set_create_acl(inode, fid, dacl, pacl);

Sounds about right, inverting the two calls probably makes sense?

OTOH I don't get why all mkdirs don't hit that.. ah, it's only a problem
if the parent directory has some ACL and none of our tests hit that :/

Well, it shouldn't be too hard to trigger & fix anyway, since you've
done this much want to send the patch?

Thanks,
-- 
Dominique Martinet | Asmadeus