From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-58-216.mail.qq.com (out162-62-58-216.mail.qq.com [162.62.58.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38B5164AA4 for ; Sun, 31 May 2026 04:37:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.58.216 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780202251; cv=none; b=grAhY7rsoBrX0lzrlu/a3Ey7bHQXMtSggIOJiJBQpdPWKKd63nz/STEXzO0h8iXZLZ2MqH4Vo+/XdWiDToQnrDqzVUkfhy0Yg0bk1ypUsfV9VrEhUgyglmarvDUGu1zfsaof+uq/bJF04Iu1sTsPI7QIkB/tDN3teKXpi2gAH+k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780202251; c=relaxed/simple; bh=TCpU6B9JBJGlnnzjLYvTCGLEP0KEvi1KFU7gMWazox8=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=RY1fRO01+sHLAbQszW+5UQ5819beI1mET/5yXyrdQ/o8vQ72A3/gcoBMabMgHJY46yo1nIUOoJY46M5DYdJpP1GLuYN79qB2wqP/QiYRSgcyeBNu0TWIXTv0mari/5F8TEgfeDo+Ji1ro6rFVPsjkClDeMCJ9DvCtFxS7xU/xfc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=Q92Dkcwy; arc=none smtp.client-ip=162.62.58.216 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="Q92Dkcwy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1780202238; bh=ufeNp8eJLjK2G+GB3pmRnaUh/DmRtLCpwV/Pe0EvA7c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Q92Dkcwy3lkINDf0tb5i6Gga03OHtg760eujg/7dW0mcXZKY/odkcgjOLc3N/p+Rs 6Ao+Srqf3E++hDME5kiNrbm6e+Py+dRCBvYjxLcLjM50z+HiSUMvEc4B2vKDL0w1aV sen0IJxodzRfo/jYCMr8vhhYy2tSzGEAco9utoSQ= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc50-0.qq.com (NewEsmtp) with SMTP id 950228E7; Sun, 31 May 2026 12:37:16 +0800 X-QQ-mid: xmsmtpt1780202236tb1jf5fqg Message-ID: X-QQ-XMAILINFO: NbgegmlEc3JunELAUBPot+5Cfv53BynKgl8arll2khyFPcQ9x87AkyLRvgc5FG jTHtmXemFY0dwalmfG/8g9cSuMHFnvGzIfA/1zzv67lvNJzFfRfyAu98SH8jMrzDGQzX3YUIEFKq ud53TKyRO8IUlVyY/qSmUQJxmGhDrNDoBEMZySwmZr8Xluhoavco3DcbDWrVssslC4zFOyUlhsz7 NpePNsFKDX+isX+r4b1ZrlmEx/jOHBvsFktxNHG7znM7nnjxTm0PnWP2itk5ctTDb75Yh3zOKu4L KprR2d2kpWvjeXDX9LQgxKsrdVi5QfLX/RKLJxKC8kOKoiu23+pTdQ7dqQukNJLTfRlssJ3gscgg Kjwr26Q6bHGBmiWbdDPvDDBps12/VaCfSTeDYmup7cu6I6b+B6K+7+2myMUcnLfzzF01fHxvU1Lv oyFr+s/f7NvrGVhK49pnz2u/6OzIedEGGFaHrc/vB6z+Z/ipxC8YEhpQJVaXc7DWVvhxDA4zjET2 OMMkLxxGkcoSoqvhFEjOxu2kd7hDm5/koCU0q27hEQYKl3f7nujso+kHnKOFIAaN/xedbLbJ9lJq x1LOjI4tW4WUeQn0181RWbmQ4pBndkuKgOWQPLtzl1tcNQGycBg4g6YfaowNOv8NlwujiUd3NmnE DaCKMS+E9Ndny6mc2lIwVgN1Lgeyxue0ZOzUnJeYFCBIiDmrc9z4LosVdm1rVxUqQXktsl02zWa4 vI6VvlZeD9wzp6MjPBpgt7zTB4Xw2gLKBKlrZOBIX3uw7T/BEJfMTD7rvsXJTEtlK09jo2jczOpe ++X2OB2+B9ZVJLj1Ws9qwXQgEdILC3J7ByVb5iptB5+4x0ZeLLPSV4d83MoatidM699M/K/3ALDA rrDEODuUjaa7N2/gnjK6o/vtUZ7WsIT1xrgfXzwyHwdwqdTsLZfXimt9HUrg/WWowCaNJjiA2TYP zxrexLRkIKc8WzpkQDzS050SHhKMY9p+a9P68Aqt5CVhuISJkbdaMp7wzTf9/LnsWk1K3WGDDe0y Npgeh5NvPOjuPjegDdu3gH/yg/Lhq0+fu2VpR0U7HtxyIPB42Q/qc9uOySwaQ= X-QQ-XMRINFO: Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg== From: Edward Adam Davis To: syzbot+3c74b1f0c372e98efc32@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [netfs?] KASAN: slab-use-after-free Read in netfs_unbuffered_write Date: Sun, 31 May 2026 12:37:16 +0800 X-OQ-MSGID: <20260531043715.359151-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a19f098.abb04025.19af7b.0003.GAE@google.com> References: <6a19f098.abb04025.19af7b.0003.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c index 25f8ceb15fad..8af58e4937c8 100644 --- a/fs/netfs/direct_write.c +++ b/fs/netfs/direct_write.c @@ -115,8 +115,11 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq) /* Check if (re-)preparation failed. */ if (unlikely(test_bit(NETFS_SREQ_FAILED, &subreq->flags))) { - netfs_write_subrequest_terminated(subreq, subreq->error); + if (!stream->construct) + netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit); wreq->error = subreq->error; + netfs_write_subrequest_terminated(subreq, subreq->error); + ret = wreq->error; break; }