Re: [syzbot] [netfs?] KASAN: slab-use-after-free Read in netfs_unbuffered_write

From: Edward Adam Davis

Date: Sun May 31 2026 - 00:37:38 EST


#syz test

diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index 25f8ceb15fad..8af58e4937c8 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -115,8 +115,11 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)

/* Check if (re-)preparation failed. */
if (unlikely(test_bit(NETFS_SREQ_FAILED, &subreq->flags))) {
- netfs_write_subrequest_terminated(subreq, subreq->error);
+ if (!stream->construct)
+ netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
wreq->error = subreq->error;
+ netfs_write_subrequest_terminated(subreq, subreq->error);
+ ret = wreq->error;
break;
}